Executive brief
E-Registrasi Pencak Silat is a web-based application used for managing registrations and scoring for martial arts competitions. A security flaw allows unauthorized individuals to access the application's database without a password. This could lead to the theft of sensitive information, including administrator login credentials and participant data.
Technical details
An SQL injection vulnerability exists in E-Registrasi Pencak Silat version 18.10 due to improper neutralization of special elements in the 'id_partai' parameter. An unauthenticated remote attacker can exploit this by sending specially crafted GET requests to the 'monitor_nilai.php' endpoint. Successful exploitation allows the attacker to execute arbitrary SQL commands, enabling the extraction of sensitive database content such as administrator usernames, passwords, and user records. The vulnerability is classified as CWE-89.
Affected products
- psychozetic E-Registrasi Pencak Silat 18.10
Timeline
- 2018-10-11: disclosed: Initial exploit published on Exploit-DB
- 2026-05-29: advisory: CVE published and assigned by VulnCheck