PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-25410 Simpkh CVE debrief

SIM-PKH 2.4.1 contains an authenticated SQL injection vulnerability in the administrative media management interface. An attacker with valid credentials can manipulate the 'id' parameter in GET requests to /admin/media.php to inject arbitrary SQL statements, including UNION-based queries that extract database metadata such as usernames, database names, and version information. The vulnerability requires low privileges and no user interaction, with network-based attack vector. The CVSS 4.0 vector indicates high confidentiality impact with limited integrity impact, and no availability impact. The weakness is classified as CWE-89 (Improper Neutralization of Special Elements in SQL Command). Vendor attribution remains uncertain with low confidence based on reference domain analysis pointing to Exploit Db as a candidate source.

Vendor
Simpkh
Product
SIM-PKH
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-30
Original CVE updated
2026-07-22
Advisory published
2026-05-30
Advisory updated
2026-07-22

Who should care

Organizations running SIM-PKH 2.4.1, particularly those exposing administrative interfaces to network access. Security teams responsible for web application security and database protection. Developers maintaining or forked versions of the SIM-PKH project.

Technical summary

The vulnerability exists in /admin/media.php when module=pengurus and act=editpengurus parameters are present. The 'id' parameter fails to properly sanitize user input, allowing SQL injection through crafted GET requests. An authenticated attacker can append SQL UNION statements to extract database information. The attack requires network access and valid authentication credentials but no user interaction. The confidentiality impact is rated high per the CVSS 4.0 vector, with limited integrity impact and no availability impact.

Defensive priority

HIGH

Recommended defensive actions

  • Apply input validation and parameterized queries to the 'id' parameter in /admin/media.php
  • Implement least-privilege database access for the application
  • Review and restrict administrative access to the media management interface
  • Monitor for suspicious UNION-based query patterns in web application logs
  • Consider web application firewall rules to detect SQL injection attempts against the pengurus module
  • Upgrade to a patched version of SIM-PKH if available from the project maintainers

Evidence notes

The vulnerability description is sourced from official vulnerability database records. Reference materials include the SIM-PKH project page on SourceForge, an Exploit-DB entry (45664), and a VulnCheck advisory specifically documenting the SQL injection via the media.php id parameter. The CVSS 4.0 vector was provided in source metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2018-25410 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2018-25410

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2018-25410 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2018-25410

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.