CVE-2018-25406: eNdonesia Portal SQL Injection Flaw

CVE-2018-25406 Overview

CVE-2018-25406 is a SQL injection vulnerability in eNdonesia Portal 8.7. The flaw exists in mod.php, which fails to sanitize multiple user-controlled parameters before passing them into SQL queries. Unauthenticated remote attackers can inject arbitrary SQL through the artid, cid, did, contid, and aboutid parameters across the publisher, diskusi, galeri, content, and about modules. Successful exploitation discloses database credentials, application usernames, and backend version information. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Unauthenticated remote attackers can extract database credentials and sensitive user data through SQL injection in mod.php, leading to full database compromise.

Affected Products

• eNdonesia Portal 8.7
• mod.php endpoint (publisher, diskusi, galeri, content, and about modules)
• Deployments distributed via the Endonesia SourceForge project

Discovery Timeline

• 2026-05-30 - CVE-2018-25406 published to NVD
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2018-25406

Vulnerability Analysis

The vulnerability resides in the request dispatcher mod.php, which routes parameters into module-specific database queries. The application concatenates parameter values directly into SQL statements without parameterized queries or input sanitization. Attackers craft URLs supplying malicious payloads via artid, cid, did, contid, or aboutid to alter query logic.

Because the affected endpoints do not require authentication, exploitation requires only network reachability to the portal. UNION-based and error-based techniques are both viable, enabling attackers to enumerate the schema, dump arbitrary tables, and read configuration metadata. Public exploit documentation is available in Exploit-DB entry 45654 and the VulnCheck advisory.

Root Cause

The root cause is the absence of prepared statements and input validation in the affected module handlers. Parameters supplied to mod.php are passed directly into MySQL queries as unescaped strings. The same insecure pattern is duplicated across five distinct modules, multiplying the attack surface.

Attack Vector

An unauthenticated attacker sends crafted HTTP GET requests to mod.php with malicious values in one of the vulnerable parameters. The injected SQL executes with the privileges of the portal's database user. Attackers commonly target the publisher module via artid, the diskusi module via did, the galeri module via cid, the content module via contid, and the about module via aboutid to extract usernames, password hashes, and MySQL version banners.

No verified, sanitized exploit code is reproduced here. Refer to the linked public advisories for proof-of-concept payloads.

Detection Methods for CVE-2018-25406

Indicators of Compromise

• HTTP requests to mod.php containing SQL keywords such as UNION, SELECT, CONCAT, 0x, or -- within the artid, cid, did, contid, or aboutid parameters.
• Web server log entries showing repeated requests to publisher, diskusi, galeri, content, or about modules from a single source.
• Unexpected MySQL queries referencing information_schema, mysql.user, or the application's user table.
• Outbound responses containing database error strings or unusually large result sets returned from mod.php.

Detection Strategies

• Deploy web application firewall (WAF) signatures for SQL injection patterns targeting the listed parameters and module names.
• Enable MySQL general or audit logging and alert on queries originating from the portal user that reference system tables.
• Correlate HTTP 500 responses from mod.php with parameter values containing SQL metacharacters.

Monitoring Recommendations

• Monitor for spikes in request volume to mod.php from individual IP addresses or scanning tools.
• Track database account behavior for queries outside the application's normal schema.
• Forward web access logs and database audit logs to a centralized SIEM for cross-source correlation and retention.

How to Mitigate CVE-2018-25406

Immediate Actions Required

• Restrict public access to the eNdonesia Portal mod.php endpoint, or place the application behind authenticated reverse-proxy controls until remediated.
• Deploy WAF rules that block SQL metacharacters in the artid, cid, did, contid, and aboutid parameters.
• Rotate database credentials referenced by the portal and review MySQL accounts for any unauthorized data access.
• Audit application logs for prior exploitation indicators dating back to initial deployment.

Patch Information

No official vendor patch is referenced in the public advisories for eNdonesia Portal 8.7. Operators should consult the Endonesia official website for current release status and consider migrating to a supported content management platform if no fix is available.

Workarounds

• Apply input validation at the reverse proxy or WAF layer to reject non-numeric values for the affected ID parameters.
• Configure the MySQL account used by the portal with least-privilege permissions, removing access to information_schema where feasible.
• Disable unused modules (publisher, diskusi, galeri, content, about) if they are not required by the deployment.
• Implement rate limiting on mod.php to slow automated SQL injection tooling.

# Example nginx rule rejecting non-numeric values for vulnerable parameters
location = /mod.php {
    if ($arg_artid  ~ "[^0-9]") { return 403; }
    if ($arg_cid    ~ "[^0-9]") { return 403; }
    if ($arg_did    ~ "[^0-9]") { return 403; }
    if ($arg_contid ~ "[^0-9]") { return 403; }
    if ($arg_aboutid ~ "[^0-9]") { return 403; }
    proxy_pass http://endonesia_backend;
}