CVE-2018-25406

## Vulnerability eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities in mod.php. The vulnerable parameters are artid, cid, did, contid, and aboutid across the publisher, diskusi, galeri, content, and about modules [1][2]. An unauthenticated attacker can inject arbitrary SQL queries through these parameters.

Exploitation

An attacker can send crafted HTTP requests to mod.php with malicious SQL payloads in the affected parameters. The attacker does not need authentication or special privileges. The injection is likely blind or error-based, enabling extraction of data from the database [2].

Impact

Successful exploitation allows an attacker to extract database credentials, usernames, and version information [2]. This could lead to further compromise of the application and underlying system.

Mitigation

As of the available references, no patch or update has been released to address these vulnerabilities. Users should consider removing or restricting access to mod.php until a fix is available [1][2].