Executive brief
MaxOn ERP Software, a system used for managing business operations and resources, contains a security flaw in its activity logging feature. An authenticated user can exploit this vulnerability to run unauthorized database commands, potentially leading to the theft of sensitive corporate data or information about the system's configuration. This could compromise the confidentiality of business records and provide a foothold for further attacks on the organization's infrastructure.
Technical details
An SQL injection vulnerability exists in MaxOn ERP Software versions 8.x through 9.x within the log_activity function of the User controller. The vulnerability is caused by improper neutralization of user-supplied input in the 'nomor', 'user', and 'jenis' POST parameters before they are concatenated into a SQL query string. An authenticated attacker can exploit this by sending specially crafted POST requests to /index.php/user/log_activity. Successful exploitation allows the attacker to execute arbitrary SQL commands, enabling the extraction of sensitive database information such as version details, database names, and potentially user data. The issue was publicly documented with proof-of-concept exploits in 2018 but assigned a CVE in 2026.
Affected products
- MaxOn ERP Software 8.x-9.x
Timeline
- 2018-10-15: disclosed: Initial exploit published on Exploit-DB
- 2026-05-29: advisory: CVE-2018-25392 published by VulnCheck/NVD