CVE-2018-25410

Vulnerability

SIM-PKH version 2.4.1 contains an SQL injection vulnerability in the /admin/media.php endpoint. The id parameter, when combined with module=pengurus and act=editpengurus GET parameters, is not properly sanitized, allowing an authenticated attacker to inject arbitrary SQL, such as UNION statements [1][3].

Exploitation

An attacker must have valid authentication credentials for the SIM-PKH application. By sending a crafted GET request to /admin/media.php with module=pengurus, act=editpengurus, and a malicious id parameter containing SQL UNION payloads, the attacker can execute arbitrary SQL queries [3]. No special privileges beyond standard user access are required.

Impact

Successful exploitation allows an authenticated attacker to extract sensitive information from the database, including usernames, database names, and database version details [3]. The scope is limited to data disclosure (confidentiality impact) and does not directly enable remote code execution or full system compromise [1].

Mitigation

As of the available references, no patched version of SIM-PKH has been released. The project appears to have moved or is unmaintained as of 2016-07-19 [2]. Users should consider upgrading to alternative software or implementing web application firewall (WAF) rules to block SQL injection patterns until a fix is available [3].