High severity7.1NVD Advisory· Published May 30, 2026· Updated Jun 1, 2026

CVE-2018-25410

Description

SIM-PKH 2.4.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to /admin/media.php with module=pengurus and act=editpengurus parameters containing SQL UNION statements to extract database information including usernames, database names, and version details.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

SIM-PKH/SIM-PKHllm-fuzzy
Range: =2.4.1

Patches

Vulnerability mechanics

References

simpkh.sourceforge.ionvd
sourceforge.net/projects/simpkh/files/latest/downloadnvd
www.exploit-db.com/exploits/45664nvd
www.vulncheck.com/advisories/sim-pkh-sql-injection-via-media-php-id-parameternvd

News mentions

No linked articles in our index yet.

cvss	0.461
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000