CVE-2018-25385 in Registrasi Pencak Silat
Summary
by MITRE • 05/29/2026
E-Registrasi Pencak Silat 18.10 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id_partai parameter. Attackers can send GET requests to monitor_nilai.php with crafted SQL payloads in the id_partai parameter to extract sensitive database information including admin credentials and user data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/14/2026
The e-registrasi pencak silat 18.10 system presents a critical sql injection vulnerability that fundamentally compromises the application's database security posture. This vulnerability exists within the monitor_nilai.php script where the id_partai parameter receives user input without proper sanitization or validation. The flaw represents a classic sql injection attack vector that allows unauthenticated remote attackers to manipulate the underlying database queries through malicious input manipulation.
The technical exploitation of this vulnerability follows standard sql injection patterns where attackers can inject malicious sql code through the id_partai parameter in get requests to monitor_nilai.php. When the application processes these requests, it directly incorporates the user-supplied parameter into sql queries without proper parameterization or input filtering mechanisms. This creates an opportunity for attackers to craft sql payloads that can manipulate the database query execution flow, potentially leading to unauthorized data access, modification, or deletion.
The operational impact of this vulnerability extends beyond simple data extraction to encompass complete database compromise. Attackers can leverage this vulnerability to extract sensitive administrative credentials, user account information, and potentially other confidential data stored within the application's database. The unauthenticated nature of the attack means that any external party can exploit this flaw without requiring valid login credentials, making the system particularly vulnerable to automated exploitation attempts. This vulnerability directly aligns with CWE-89 sql injection weakness classification and represents a significant risk to the confidentiality and integrity of the application's data assets.
The security implications of this vulnerability can be analyzed through the lens of the mitre attack framework where this represents a data extraction technique that can be used to gain access to sensitive information. Organizations utilizing this system face potential exposure to credential theft, data leakage, and unauthorized database manipulation. The vulnerability demonstrates poor input validation practices and highlights the critical need for proper parameterized query implementation. Mitigation strategies should include immediate implementation of input sanitization, parameterized queries, and comprehensive input validation for all user-supplied data. Additionally, regular security assessments and code reviews should be conducted to identify and remediate similar vulnerabilities throughout the application codebase. The system should also implement proper access controls and database user privilege management to limit the potential damage from any successful exploitation attempts.