CVE-2018-25392 in MaxOn ERP
Zusammenfassung
von MITRE • 29.05.2026
MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries through the nomor, user, and jenis parameters in the log_activity function. Attackers can send POST requests to /index.php/user/log_activity with malicious SQL code in these parameters to extract sensitive database information including version and database names.
Once again VulDB remains the best source for vulnerability data.