Executive brief
SIM-PKH, a web application used for managing social assistance program data, contains a security flaw that allows logged-in users to access unauthorized information. By sending specially crafted web requests, an attacker can bypass security controls to view sensitive database details, including usernames and system configuration. This could lead to a broader compromise of the application's data and underlying server infrastructure.
Technical details
An SQL injection vulnerability exists in SIM-PKH version 2.4.1 within the '/admin/media.php' endpoint. The root cause is improper neutralization of the 'id' GET parameter when the 'module' is set to 'pengurus' and 'act' is set to 'editpengurus'. An authenticated attacker can exploit this by submitting SQL UNION statements to execute arbitrary queries. Successful exploitation allows the attacker to extract sensitive information from the database, such as database names, version details, and user credentials. While the software is reportedly discontinued in favor of HaPe-PKH, users are advised to restrict access to the admin interface or migrate to the newer platform.
Affected products
- SIM-PKH Project SIM-PKH 2.4.1
Timeline
- 2018-10-22: disclosed: Original exploit published on Exploit-DB
- 2026-05-30: advisory: CVE-2018-25410 published/updated in NVD