CVE-2018-25386
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php that allow attackers to manipulate database queries via the 'id' parameter. An unauthenticated attacker can exploit the desa module, while authenticated users can exploit pengurus, fasilitas, and kelompok modules, leading to extraction of sensitive data such as current user, database name, and DBMS version.
Risk Assessment
The risk for the organization includes unauthorized access to sensitive database information, potentially leading to system integrity compromise and exposure of IT infrastructure details.
Recommendation
Immediately update HaPe PKH to the latest version; if unavailable, implement input validation and parameterized queries in admin/media.php and restrict access to the admin panel.
Other vulnerabilities in HaPe PKH
See all- CVE-2018-25391High
A vulnerability in HaPe PKH 1.1 allows unauthenticated attackers to delete arbitrary records by sending a crafted request specifying the target record's ID. The endpoints admin/modul/mod_pengurus/aksi_pengurus.php and admin/modul/mod_update/aksi_update.php do not verify privileges before performing deletion operations.
- CVE-2018-25390High
An SQL injection vulnerability in HaPe PKH 1.1 allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'desa' POST parameter sent to lap-peserta-perdesa-pdf.php. Attackers can send a crafted request with a time-based blind payload to infer and extract sensitive database information.
- CVE-2018-25389High
An SQL injection vulnerability in HaPe PKH 1.1 allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'nama_kelompok' POST parameter sent to lap-anggota-kelompok-pdf.php. Attackers can send a crafted request with a time-based blind payload to infer and extract sensitive database information.
- CVE-2018-25388High
HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to bypass file type validation and upload malicious files. Through endpoints aksi_foto.php, aksi_user.php, and aksi_kecamatan.php, they can upload PHP files and execute arbitrary code on the server.
- CVE-2018-25387Medium
HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint. Attackers can craft malicious forms targeting the aksi_user.php script with parameters like id_user, password, and level to modify admin credentials without authentication.
Original NVD description (English source)
HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php that allow attackers to manipulate database queries by injecting SQL code through the 'id' parameter. An unauthenticated attacker can exploit the desa module (module=desa&act=hapus), while authenticated users can exploit the pengurus, fasilitas, and kelompok modules (for example act=print, act=editpengurus, act=editfasilitas, and act=editkelompok). Successful exploitation allows extraction of sensitive database information including the current user, database name, and DBMS version.