CVE-2018-25385 Overview
CVE-2018-25385 is a SQL injection vulnerability [CWE-89] in E-Registrasi Pencak Silat version 18.10. The flaw resides in the monitor_nilai.php script, which fails to sanitize the id_partai GET parameter before incorporating it into a SQL query. Unauthenticated attackers can send crafted HTTP requests to extract sensitive database contents, including administrator credentials and registrant data. The vulnerability requires no privileges and no user interaction, making it exploitable directly over the network against any exposed instance of the application.
Critical Impact
Remote, unauthenticated attackers can extract administrator credentials and confidential database records by injecting SQL through the id_partai parameter.
Affected Products
- E-Registrasi Pencak Silat 18.10
- Installations distributed via the SourceForge eregistrasi-kejuaraan-silat project
- Deployments exposing monitor_nilai.php to untrusted networks
Discovery Timeline
- 2026-05-29 - CVE-2018-25385 published to the National Vulnerability Database
- 2026-05-29 - Last updated in NVD database
Technical Details for CVE-2018-25385
Vulnerability Analysis
The vulnerability stems from unsanitized user input being concatenated into a SQL statement within monitor_nilai.php. The id_partai GET parameter is passed directly to the backend database engine, allowing attackers to break out of the intended query context. Attackers can append boolean-based, union-based, or time-based SQL payloads to enumerate tables, columns, and rows.
Because the vulnerable endpoint serves match-monitoring functionality, it is typically reachable without authentication. Exploitation yields read access to sensitive tables, including administrator accounts and participant records. Public exploitation guidance is available through Exploit-DB #45582 and the VulnCheck SQL Injection Advisory.
Root Cause
The application constructs SQL queries by string concatenation rather than using parameterized statements or prepared queries. Input received from the id_partai GET parameter passes to the database without type validation, allow-listing, or escaping. This violates the secure coding principle of separating code from data, classified as Improper Neutralization of Special Elements used in an SQL Command [CWE-89].
Attack Vector
An attacker issues a GET request to monitor_nilai.php with a malicious value in the id_partai parameter. Typical payloads include UNION SELECT clauses to surface column data, conditional OR 1=1 predicates to bypass logic, or time-delay functions for blind extraction. Automated tools such as sqlmap can enumerate the schema and dump credential tables without user interaction.
No authentication, session token, or referer check protects the endpoint. The vulnerable parameter is reachable directly from the internet on exposed deployments. For background on the affected codebase, see the SourceForge Project Overview.
Detection Methods for CVE-2018-25385
Indicators of Compromise
- GET requests to monitor_nilai.php containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or -- in the id_partai parameter
- Anomalous database errors or extended response times correlated with requests to monitor_nilai.php
- Outbound web requests originating from known offensive security scanners targeting the id_partai parameter
- Unexpected reads against administrator credential tables in the application database
Detection Strategies
- Inspect web server access logs for URL-encoded SQL metacharacters (%27, %22, %23, %2D%2D) within the id_partai parameter
- Deploy a Web Application Firewall (WAF) signature targeting SQL injection patterns on the monitor_nilai.php endpoint
- Enable database query logging and alert on UNION SELECT statements referencing user or admin tables
- Correlate HTTP 500 responses from monitor_nilai.php with sequential requests from the same client IP
Monitoring Recommendations
- Forward web server and database logs to a centralized SIEM for correlation and retention
- Establish a baseline of normal id_partai values and alert on deviations such as long strings or special characters
- Monitor authentication tables for unexpected administrator logins following suspicious web traffic
- Track repeated parameter tampering attempts from a single source IP as a potential reconnaissance indicator
How to Mitigate CVE-2018-25385
Immediate Actions Required
- Restrict network exposure of the application to trusted networks or behind a VPN until remediated
- Deploy a WAF rule that blocks SQL metacharacters in the id_partai parameter of monitor_nilai.php
- Rotate all administrator credentials and review the user table for unauthorized accounts
- Audit application and database logs for prior exploitation evidence
Patch Information
No vendor patch is referenced in the published advisory. The affected codebase is distributed through the SourceForge Download Link. Operators should manually remediate the source by replacing the dynamic SQL construction in monitor_nilai.php with parameterized queries using mysqli_prepare() or PDO prepared statements with bound parameters.
Workarounds
- Cast the id_partai parameter to an integer in PHP before use, for example $id = (int)$_GET['id_partai'];
- Implement strict input validation that rejects any non-numeric value for id_partai
- Apply least-privilege database accounts so the web user cannot read the administrator credentials table
- Disable or remove the monitor_nilai.php endpoint if it is not required for operations
# Example ModSecurity rule blocking SQL metacharacters in id_partai
SecRule ARGS:id_partai "@rx (?i)(union|select|sleep|benchmark|--|';|\")" \
"id:1002025,phase:2,deny,status:403,log,msg:'CVE-2018-25385 SQLi attempt on id_partai'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
