PatchSiren cyber security CVE debrief
CVE-2018-25410 Simpkh CVE debrief
SIM-PKH 2.4.1 contains an authenticated SQL injection vulnerability in the administrative media management interface. An attacker with valid credentials can manipulate the 'id' parameter in GET requests to /admin/media.php to inject arbitrary SQL statements, including UNION-based queries that extract database metadata such as usernames, database names, and version information. The vulnerability requires low privileges and no user interaction, with network-based attack vector. The CVSS 4.0 vector indicates high confidentiality impact with limited integrity impact, and no availability impact. The weakness is classified as CWE-89 (Improper Neutralization of Special Elements in SQL Command). Vendor attribution remains uncertain with low confidence based on reference domain analysis pointing to Exploit Db as a candidate source.
- Vendor
- Simpkh
- Product
- SIM-PKH
- CVSS
- HIGH 7.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-30
- Original CVE updated
- 2026-05-30
- Advisory published
- 2026-05-30
- Advisory updated
- 2026-05-30
Who should care
Organizations running SIM-PKH 2.4.1, particularly those exposing administrative interfaces to network access. Security teams responsible for web application security and database protection. Developers maintaining or forked versions of the SIM-PKH project.
Technical summary
The vulnerability exists in /admin/media.php when module=pengurus and act=editpengurus parameters are present. The 'id' parameter fails to properly sanitize user input, allowing SQL injection through crafted GET requests. An authenticated attacker can append SQL UNION statements to extract database information. The attack requires network access and valid authentication credentials but no user interaction. The confidentiality impact is rated high per the CVSS 4.0 vector, with limited integrity impact and no availability impact.
Defensive priority
HIGH
Recommended defensive actions
- Apply input validation and parameterized queries to the 'id' parameter in /admin/media.php
- Implement least-privilege database access for the application
- Review and restrict administrative access to the media management interface
- Monitor for suspicious UNION-based query patterns in web application logs
- Consider web application firewall rules to detect SQL injection attempts against the pengurus module
- Upgrade to a patched version of SIM-PKH if available from the project maintainers
Evidence notes
The vulnerability description is sourced from official vulnerability database records. Reference materials include the SIM-PKH project page on SourceForge, an Exploit-DB entry (45664), and a VulnCheck advisory specifically documenting the SQL injection via the media.php id parameter. The CVSS 4.0 vector was provided in source metadata.
Official resources
CVE-2018-25410 was published on 2026-05-30T16:17:01.723Z and modified on the same date. The vulnerability affects SIM-PKH version 2.4.1. No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed.