Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-25410: SIM-PKH 2.4.1 allows attackers to steal database information

CVE-2018-25410 · published 5 months ago

Summary

The SIM-PKH software version 2.4.1 has a security weakness that lets an attacker who is already logged in access sensitive information from the database by sending a special request. This could allow the attacker to learn about the system and potentially gain more access. You should update to a fixed version of SIM-PKH to protect against this risk.

Original advisory text

SIM-PKH 2.4.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to /admin/media.php with module=pengurus and act=editpengurus parameters containing SQL UNION statements to extract database information including usernames, database names, and version details.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published30 May 2026

Updated4 Nov 2026

First seen30 May 2026

Sources

CVE-2018-25410 · NVD

Track software like this

Free during beta