Description
HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'desa' POST parameter sent to lap-peserta-perdesa-pdf.php. Attackers can send a crafted request with a time-based blind payload to infer and extract sensitive database information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sitejo | HaPe PKH | 1.1 | — |
References
- ExploitDB-45588 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: HaPe PKH 1.1 SQL Injection via desa Parameter third-party-advisory