CVE-2018-25386 Details
Description
HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php that allow attackers to manipulate database queries by injecting SQL code through the 'id' parameter. An unauthenticated attacker can exploit the desa module (module=desa&act=hapus), while authenticated users can exploit the pengurus, fasilitas, and kelompok modules (for example act=print, act=editpengurus, act=editfasilitas, and act=editkelompok). Successful exploitation allows extraction of sensitive database information including the current user, database name, and DBMS version.
A SQL injection vulnerability has been identified in HaPe PKH version 1.1, specifically within the admin/media.php file. This vulnerability allows attackers to manipulate database queries by injecting SQL code through the 'id' parameter. Unauthenticated attackers can exploit this issue in the desa module, while authenticated users can target the pengurus, fasilitas, and kelompok modules. Successful exploitation could lead to the extraction of sensitive database information, including details about the current user, database name, and DBMS version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 29, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://sourceforge.net/projects/hape-pkh/files/latest/download | [email protected] | ProductVendor |
| https://www.exploit-db.com/exploits/45588 | [email protected] | Exploit |
| https://www.vulncheck.com/advisories/hape-pkh-sql-injection-via-id-parameter-in-admin-media-php | [email protected] | AdvisoryBundle |
| http://www.sitejo.id | [email protected] | Broken LinkVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HaPe PKH | <= 1.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | New CVE Received | [email protected] |