CVE-2018-25406: SQL Injection Across eNdonesia Portal 8.7 Modules

CVE-2018-25406: SQL Injection Across eNdonesia Portal 8.7 Modules

Multiple SQL injection vulnerabilities originally discovered in 2018 have been formally assigned as CVE-2018-25406 with a CVSS score of 8.2 (High). The flaws reside in eNdonesia Portal version 8.7 and are closely related to CVE-2018-25405, covering additional injection points across the publisher, artikel, and info modules in mod.php.

The vulnerabilities allow unauthenticated attackers to execute arbitrary SQL queries by injecting payloads through the artid, cid, did, contid, and aboutid parameters across different module contexts, enabling cross-module database enumeration and data extraction.

Vulnerability Overview

Technical Details

Similar to CVE-2018-25405, this vulnerability involves unsanitized parameters in mod.php across the publisher, artikel, and info modules. The same parameters (artid, cid, did, contid, aboutid) are used in different query contexts within these modules, creating multiple independently exploitable injection paths.

Cross-module exploitation examples:

# Publisher module — article ID injection
GET /mod.php?mod=publisher&artid=1 UNION SELECT 1,username,password,4 FROM users--

# Artikel module — category injection  
GET /mod.php?mod=artikel&cid=1' UNION SELECT table_name,2 FROM information_schema.tables--

# Info module — content ID injection
GET /mod.php?mod=info&contid=1 AND 1=2 UNION SELECT user(),version()--

The cross-module nature of this vulnerability means that even if one module is disabled or restricted, the same injection may succeed via a different module using the same underlying parameter handling code.

Attack chain:

1. Identify accessible modules via module enumeration
2. Test each parameter for injectable behavior using time-based or boolean-based blind SQLi
3. Extract information_schema to enumerate tables
4. Dump target tables (credentials, user data, session tokens)

Successful exploitation allows an attacker to:

• Extract credentials from the admin and user tables
• Read sensitive content including unpublished articles and private user data
• Enumerate the entire database schema across all eNdonesia modules
• Chain with other vulnerabilities — extracted admin credentials may enable further compromise

Relationship to CVE-2018-25405

CVE-2018-25406 and CVE-2018-25405 both affect the same parameter handling code in mod.php of eNdonesia Portal 8.7. The distinction is the set of modules covered:

Both CVEs carry the same CVSS 8.2 score and require the same remediation approach. Installations affected by one are almost certainly affected by both.

Context and Impact

eNdonesia Portal 8.7 is a legacy Indonesian CMS with limited deployment outside its original regional user base. The formal NVD assignment of CVE-2018-25406 alongside CVE-2018-25405 underscores the systemic nature of the SQL injection flaws — the root cause is the same absent parameterization across the entire mod.php dispatch layer.

Who is affected:

• Indonesian community portals, news sites, and legacy web properties running eNdonesia Portal 8.7
• Any fork or customization that retained the original mod.php parameter handling

Practical risk: The dual-CVE assignment for essentially the same codebase flaw highlights that a single architectural weakness (direct parameter interpolation in SQL) can generate numerous CVEs depending on enumeration granularity. Attackers need only one working injection vector to compromise the database.

Remediation

1. Upgrade or migrate — update to a patched version of eNdonesia Portal or migrate to a maintained CMS
2. Parameterized queries — refactor mod.php to use PDO prepared statements for all parameter-driven queries
3. Input validation — numeric ID parameters should be strictly cast with intval() as a defense-in-depth measure
4. Disable unused modules — reduce attack surface by disabling modules not in active use

Patching the root cause:

// Vulnerable dispatch pattern in mod.php
$cid = $_GET['cid'];
$result = mysql_query("SELECT * FROM kategori WHERE cid='$cid'");
 
// Secure pattern — parameterized with PDO
$stmt = $pdo->prepare("SELECT * FROM kategori WHERE cid = :cid");
$stmt->bindParam(':cid', $_GET['cid'], PDO::PARAM_INT);
$stmt->execute();

Key Takeaways

1. CVE-2018-25406 is a CVSS 8.2 High SQL injection flaw in eNdonesia Portal 8.7 covering the publisher, artikel, and info modules
2. Closely related to CVE-2018-25405 — both stem from the same root cause in mod.php and should be remediated together
3. Cross-module attack surface — the same injection technique works across multiple modules, increasing exploitability
4. Remediation: Upgrade, apply parameterized queries across all of mod.php, or migrate to a maintained CMS

Sources

• CVE-2018-25406 — NIST NVD