CVE-2018-25389: HaPe PKH 1.1 SQL Injection Vulnerability

CVE-2018-25389 Overview

CVE-2018-25389 is a SQL injection vulnerability [CWE-89] in HaPe PKH 1.1, a PHP-based application distributed through SourceForge. The flaw resides in lap-anggota-kelompok-pdf.php, which fails to sanitize the nama_kelompok POST parameter before incorporating it into a database query. Unauthenticated attackers can submit time-based blind SQL injection payloads to infer database contents byte by byte. Successful exploitation exposes credentials, application data, and other records stored in the backend database.

Critical Impact
Unauthenticated network-based SQL injection enables full extraction of database contents without user interaction or prior privileges.

Affected Products

HaPe PKH 1.1
Distributions sourced from the SourceForge HaPe PKH project
Deployments referenced via the SiteJo project homepage

Discovery Timeline

2026-05-29 - CVE-2018-25389 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2018-25389

Vulnerability Analysis

The vulnerability exists in the report generation script lap-anggota-kelompok-pdf.php. The script accepts a POST parameter named nama_kelompok and concatenates the value directly into a SQL statement executed against the application database. Because no prepared statements, parameter binding, or input validation are applied, attackers control fragments of the SQL grammar.

Attackers exploit the flaw using time-based blind techniques. By injecting conditional SLEEP() payloads, the attacker observes server response delays to infer the truth value of arbitrary SQL expressions. This permits character-by-character extraction of tables, columns, and rows from the underlying database. The issue is referenced in the Exploit-DB entry #45588 and the VulnCheck advisory.

Root Cause

The root cause is unsafe string concatenation of untrusted HTTP input into a SQL query. HaPe PKH 1.1 does not enforce parameterized queries or input filtering on the nama_kelompok field, leaving the SQL parser exposed to attacker-controlled tokens.

Attack Vector

The attack is delivered over the network using a crafted HTTP POST request targeting lap-anggota-kelompok-pdf.php. No authentication, user interaction, or specific privileges are required. The attacker requires only reachability to the web application and knowledge of the vulnerable endpoint and parameter name.

No verified exploitation code is republished here. Technical payload details are documented in the public advisories listed above.

Detection Methods for CVE-2018-25389

Indicators of Compromise

POST requests to lap-anggota-kelompok-pdf.php containing SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or -- inside the nama_kelompok parameter.
Repeated requests to the same endpoint with incrementing payload variations indicating automated extraction.
Database query latencies that correlate with inbound requests carrying suspicious nama_kelompok values.

Detection Strategies

Inspect web server access logs for POST requests to lap-anggota-kelompok-pdf.php with non-alphanumeric characters in nama_kelompok.
Deploy a Web Application Firewall (WAF) rule set targeting SQL injection signatures on the affected endpoint.
Correlate database slow-query logs with web request timestamps to identify time-based blind injection attempts.

Monitoring Recommendations

Forward web server and database logs to a centralized analytics platform for cross-source correlation.
Alert on unauthenticated POST traffic to PDF report endpoints from external IP ranges.
Baseline normal request volume to lap-anggota-kelompok-pdf.php and trigger on volumetric or latency anomalies.

How to Mitigate CVE-2018-25389

Immediate Actions Required

Restrict network access to HaPe PKH 1.1 deployments using firewall rules or VPN-only access until a fix is applied.
Disable the lap-anggota-kelompok-pdf.php endpoint if the PDF report function is not in active use.
Audit the application database for unexpected reads, new accounts, or modified records.

Patch Information

No vendor patch is referenced in the available data. Operators should monitor the SourceForge HaPe PKH project page for updated releases and review the VulnCheck advisory for remediation status.

Workarounds

Place the application behind a WAF configured to block SQL metacharacters in the nama_kelompok parameter.
Modify lap-anggota-kelompok-pdf.php locally to use prepared statements with bound parameters instead of string concatenation.
Enforce least-privilege database accounts so the web application user cannot read sensitive tables outside its scope.

bash

# Example WAF rule (ModSecurity) blocking SQLi tokens in the vulnerable parameter
SecRule ARGS:nama_kelompok "@rx (?i)(union(\s|/\*).*select|sleep\s*\(|benchmark\s*\(|--|;)" \
    "id:1002501,phase:2,deny,status:403,log,msg:'CVE-2018-25389 SQLi attempt on nama_kelompok'"