CVE-2018-25392

Vulnerability

MaxOn ERP Software versions 8.x through 9.x are vulnerable to SQL injection in the log_activity function located in /pos/controllers/User.php (line 350) and /application/controllers/User.php (line 414) [1]. The function constructs a SQL query by directly concatenating user-supplied input from the nomor, user, and jenis POST parameters without sanitization [1][2]. This allows authenticated users to inject arbitrary SQL code.

Exploitation

An attacker must be an authenticated user of the MaxOn ERP system. By sending a POST request to /index.php/user/log_activity with malicious payloads in the nomor, user, or jenis parameters, the attacker can manipulate the SQL query. The provided proof-of-concept demonstrates injecting a UNION-based payload to extract database version and name [1]. The attack requires no special privileges beyond a valid session.

Impact

Successful exploitation enables an authenticated attacker to execute arbitrary SQL queries, leading to disclosure of sensitive database information such as the database version and database names [1][2]. The attacker can potentially extract other data from the database, depending on the database permissions.

Mitigation

As of the available references, no official patch has been released for this vulnerability. The vendor homepage is listed as http://www.talagasoft.com, but no update is mentioned [1]. Users should consider restricting access to the vulnerable endpoint or implementing input validation as a workaround. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.