Description
SIM-PKH 2.4.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to /admin/media.php with module=pengurus and act=editpengurus parameters containing SQL UNION statements to extract database information including usernames, database names, and version details.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Simpkh | SIM-PKH | 2.4.1 | — |
References
- ExploitDB-45664 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: SIM-PKH 2.4.1 SQL Injection via media.php id Parameter third-party-advisory