CVE-2018-25392: MaxOn ERP Software SQLi Vulnerability

CVE-2018-25392 Overview

CVE-2018-25392 is an SQL injection vulnerability [CWE-89] affecting MaxOn ERP Software versions 8.x through 9.x. The flaw resides in the log_activity function, which fails to sanitize the nomor, user, and jenis parameters before incorporating them into SQL queries. Authenticated attackers can send crafted POST requests to /index.php/user/log_activity to execute arbitrary SQL statements against the backend database. Successful exploitation enables extraction of sensitive data, including database version strings and schema names. The vulnerability requires low-privilege authentication but no user interaction, and it is exploitable over the network.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries through the log_activity endpoint to enumerate database structure and exfiltrate confidential records from MaxOn ERP deployments.

Affected Products

MaxOn ERP Software 8.x
MaxOn ERP Software 9.x
Deployments using the /index.php/user/log_activity endpoint

Discovery Timeline

2026-05-29 - CVE-2018-25392 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2018-25392

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input in the log_activity function of MaxOn ERP. The application concatenates the nomor, user, and jenis POST parameters directly into SQL statements without parameterization or escaping. An authenticated attacker can append SQL operators such as UNION SELECT or boolean clauses to manipulate query logic. Public proof-of-concept material on Exploit-DB demonstrates extraction of version() and database() values through the nomor parameter. The flaw is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Root Cause

The log_activity handler builds SQL queries using string concatenation with unvalidated request parameters. No prepared statements, input whitelisting, or output encoding are applied before query execution. This design allows any authenticated session to inject syntactically valid SQL fragments into the query plan.

Attack Vector

An attacker authenticates to the application with any valid low-privilege account. The attacker then issues a POST request to /index.php/user/log_activity containing a malicious payload in the nomor, user, or jenis parameter. The injected payload alters the SQL query to return attacker-controlled data such as database metadata, table contents, or credentials. Refer to the Exploit-DB #45605 advisory and the VulnCheck advisory on MaxOn ERP SQL Injection for full request structure and payload syntax.

Detection Methods for CVE-2018-25392

Indicators of Compromise

POST requests to /index.php/user/log_activity containing SQL keywords such as UNION, SELECT, --, or 0x in the nomor, user, or jenis parameters.
Web server access logs showing unusually long parameter values or encoded characters targeting the log_activity endpoint.
Database error messages or anomalous query latency originating from the MaxOn ERP application user.

Detection Strategies

Deploy web application firewall rules that inspect POST bodies to /index.php/user/log_activity for SQL metacharacters and tautology patterns.
Enable database query auditing to flag statements referencing information_schema, version(), or database() issued by the ERP service account.
Correlate authentication events with log_activity POST traffic to identify accounts generating injection-style payloads.

Monitoring Recommendations

Forward MaxOn ERP web server and database logs to a centralized SIEM for cross-source correlation.
Alert on spikes in HTTP 500 responses from the log_activity endpoint, which often indicate failed injection attempts.
Baseline normal parameter lengths and content for nomor, user, and jenis, and alert on outliers.

How to Mitigate CVE-2018-25392

Immediate Actions Required

Restrict access to the MaxOn ERP web interface to trusted networks using firewall or VPN controls.
Audit application accounts and disable unused or default credentials to reduce the authenticated attack surface.
Deploy WAF signatures targeting SQL injection patterns on the /index.php/user/log_activity endpoint.

Patch Information

No vendor patch is referenced in the available advisories. Operators should contact Talaga Soft, the developer behind MaxOn ERP, for guidance on supported versions and remediation. Review the VulnCheck advisory on MaxOn ERP SQL Injection for the most current vendor status.

Workarounds

Implement a reverse proxy rule that rejects POST requests to /index.php/user/log_activity containing SQL metacharacters such as single quotes, UNION, or comment sequences.
Apply database-level least privilege so the ERP service account cannot read information_schema or unrelated schemas.
Place the application behind an authenticating reverse proxy that enforces multi-factor authentication before exposing the vulnerable endpoint.

bash

# Example ModSecurity rule to block SQLi attempts against log_activity
SecRule REQUEST_URI "@streq /index.php/user/log_activity" \
  "phase:2,chain,deny,status:403,id:1002501,msg:'Possible SQLi on MaxOn ERP log_activity'"
  SecRule ARGS:nomor|ARGS:user|ARGS:jenis "@rx (?i)(union\s+select|--|/\*|information_schema|version\(|database\()" \
    "t:none,t:urlDecodeUni"