SQL Injection in eNdonesia Portal Parameter Handling

eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters to extract sensitive database information including usernames, database names, and version details.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

eNdonesia Portal 8.7 suffers from multiple SQL injection vulnerabilities in its mod.php file, where user-supplied input from parameters (artid, cid, did, contid, aboutid) is directly concatenated into SQL queries without proper sanitization or parameterized statements. This CWE-89 vulnerability allows unauthenticated attackers to bypass authentication entirely and execute arbitrary SQL commands, potentially exposing sensitive database information including usernames, database names, and version details. Organizations running this portal version—particularly government and institutional deployments in Southeast Asia—face immediate risk of data exfiltration, unauthorized access, and potential lateral movement within their infrastructure. The unauthenticated nature of this attack makes it particularly dangerous, as no valid credentials are required for exploitation.

Casky's 301 mapped skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this CVE across two critical MITRE ATT&CK techniques: Reconnaissance (TA0001) and Resource Development (TA0043). Practitioners would observe detections for SQL query pattern anomalies, suspicious parameter encoding in web logs, and database query execution chains that indicate injection attempts. The platform's skills correlate multiple indicators—unusual SQL syntax in HTTP parameters, database error messages revealing schema information, and time-based or union-based injection signatures—to identify exploitation attempts before data extraction occurs. By mapping these behavioral patterns to the specific vulnerable parameters, security teams gain visibility into reconnaissance activities where attackers probe for injectable parameters, and resource development activities where they craft and test malicious payloads.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2018-25405.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2018-25405

Casky has 301 skills that investigate the attack patterns behind CVE-2018-25405. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn