CVE-2018-25410: SIM-PKH 2.4.1 SQL Injection Vulnerability

CVE-2018-25410 Overview

CVE-2018-25410 is a SQL injection vulnerability in SIM-PKH 2.4.1, a PHP-based information management system. The flaw resides in the id parameter of the /admin/media.php endpoint when invoked with the module=pengurus and act=editpengurus parameters. Authenticated attackers can inject SQL UNION statements through GET requests to extract sensitive database information, including usernames, database names, and version details. The vulnerability is classified as Improper Neutralization of Special Elements used in an SQL Command [CWE-89].

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the back-end database, exposing credentials and schema details that enable further compromise.

Affected Products

SIM-PKH version 2.4.1
SIM-PKH admin/media.php administrative interface
Deployments distributed through the SimpKH SourceForge project

Discovery Timeline

2026-05-30 - CVE-2018-25410 published to the National Vulnerability Database (NVD)
2026-06-01 - Record last updated in NVD

Technical Details for CVE-2018-25410

Vulnerability Analysis

The vulnerability stems from unsanitized user input being concatenated into a SQL statement on the administrative media endpoint. When a request reaches /admin/media.php with module=pengurus and act=editpengurus, the application reads the id parameter and passes it into a query without parameterization. Attackers append a UNION SELECT clause to the id value to merge attacker-controlled result sets with the legitimate query output.

Successful exploitation yields direct disclosure of database contents. Reported extraction targets include user(), database(), and version(), which reveal the database account in use, the active schema, and the underlying database server version. The flaw requires authentication, but any user holding administrative session access to the affected module can trigger it.

Root Cause

The root cause is the absence of input validation and prepared statements when handling the id GET parameter in admin/media.php. The query builder trusts client-supplied data, allowing query structure to be altered at runtime.

Attack Vector

An authenticated attacker sends a crafted HTTP GET request to /admin/media.php?module=pengurus&act=editpengurus&id=<payload> where the payload contains a UNION-based SQL injection string. The injected query is reflected through the application response, allowing extraction of database metadata and arbitrary table contents. See the VulnCheck SQL Injection Advisory and Exploit-DB #45664 for the documented request pattern.

No verified exploitation code is reproduced here. Refer to the linked advisories for technical proof-of-concept details.

Detection Methods for CVE-2018-25410

Indicators of Compromise

HTTP GET requests to /admin/media.php containing module=pengurus and act=editpengurus with SQL syntax in the id parameter
Request strings containing UNION SELECT, information_schema, user(), database(), or version() keywords in URL parameters
Web server access logs showing repeated requests to the same endpoint with incrementing or encoded id values
Database error messages or unusually large response bodies returned from admin/media.php

Detection Strategies

Inspect web server and application logs for SQL meta-characters such as single quotes, comment markers (--, #), and UNION clauses within GET parameters
Deploy a web application firewall (WAF) signature targeting UNION-based injection patterns on administrative PHP endpoints
Correlate authenticated administrative sessions with anomalous query patterns or unexpected database read volumes

Monitoring Recommendations

Forward web server, PHP error, and database query logs to a centralized analytics platform for retention and pattern matching
Alert on response anomalies, including unexpected content lengths or HTTP 500 errors from admin/media.php
Monitor authenticated administrator accounts for atypical access times or source IP addresses preceding suspicious requests

How to Mitigate CVE-2018-25410

Immediate Actions Required

Restrict access to the /admin/ directory by source IP address or VPN to limit who can reach the vulnerable endpoint
Audit administrative accounts and rotate credentials, particularly the database account used by the application
Review web server logs for prior exploitation attempts referencing module=pengurus&act=editpengurus
Disable or remove the SIM-PKH installation if it is no longer required for business operations

Patch Information

No official vendor patch is referenced in the NVD entry or in the SimpKH Project Overview. Operators should confirm with the project whether a newer release addresses the issue and, if not, apply input validation fixes locally by replacing concatenated SQL with parameterized queries or PDO prepared statements.

Workarounds

Place the application behind a WAF configured to block SQL injection payloads on GET parameters
Implement server-side input filtering that rejects non-numeric values for the id parameter on admin/media.php
Apply least-privilege principles to the database account, removing rights to read system schemas such as information_schema
Enforce multi-factor authentication on administrative accounts to raise the cost of credential compromise

bash

# Example NGINX rule to block UNION-based payloads on the vulnerable endpoint
location /admin/media.php {
    if ($args ~* "(union[\s\+]+select|information_schema|--|/\*)") {
        return 403;
    }
    if ($arg_id !~ "^[0-9]+$") {
        return 400;
    }
}