Unauthenticated SQL Injection in eNdonesia Portal

eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters across publisher, diskusi, galeri, content, and about modules to extract database information including usernames, database names, and version details.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

eNdonesia Portal 8.7 suffers from multiple unauthenticated SQL injection vulnerabilities that expose critical database information without requiring any user authentication. Attackers can inject malicious SQL code through multiple parameters (artid, cid, did, contid, and aboutid) across several modules including publisher, diskusi, galeri, content, and about—creating a broad attack surface. This vulnerability is particularly dangerous because it allows complete database enumeration, enabling attackers to extract usernames, database names, and version information that can be weaponized for privilege escalation or lateral movement. Organizations running eNdonesia Portal 8.7 face immediate risk of data exfiltration and potential compromise of administrative credentials stored in the database.

Casky's 301 matching skills leverage Claude AI's extended reasoning to detect the reconnaissance and exploitation patterns underlying this vulnerability. By mapping to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance - Gather victim identity information), practitioners using Casky will identify attack chains where adversaries first probe mod.php parameters to fingerprint the database structure and version (TA0043), then systematically extract sensitive data like administrative usernames and hashes. The platform's skills enable detection of suspicious parameter patterns, unusual database queries in logs, and the characteristic error messages or timing variations that reveal SQL injection attempts. Security teams receive specific findings showing which parameters are vulnerable, what data was accessed, and how these techniques chain together—providing the intelligence needed to prioritize patches and implement Web Application Firewall rules to block malicious input before it reaches the database layer.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2018-25407.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2018-25407

Casky has 301 skills that investigate the attack patterns behind CVE-2018-25407. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn