SQL Injection in SIM-PKH Admin Media Parameter

SIM-PKH 2.4.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to /admin/media.php with module=pengurus and act=editpengurus parameters containing SQL UNION statements to extract database information including usernames, database names, and version details.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

SIM-PKH 2.4.1 contains a critical SQL injection vulnerability in its administrative interface that allows authenticated attackers to execute arbitrary SQL queries. By injecting malicious SQL code through the 'id' parameter in GET requests to /admin/media.php, attackers can bypass query constraints and extract sensitive database information including usernames, database names, and version details. This vulnerability is particularly dangerous because it affects the admin panel—a high-value target—and requires only authentication rather than zero-day exploitation. Organizations running SIM-PKH 2.4.1 are immediately at risk of data exfiltration and potential privilege escalation if database credentials or sensitive application data are compromised.

Casky's 301 mapped security skills detect this attack pattern by correlating SQL injection indicators with the MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance via Web). Practitioners using Claude AI's extended reasoning capabilities would observe detection signals for CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) combined with behavioral patterns including: unusual SQL UNION statements in GET parameters, repeated requests to /admin/media.php with varying 'id' values, abnormal database query patterns, and data exfiltration from admin endpoints. The platform would correlate these findings across multiple skills to highlight the reconnaissance activity and data gathering attempts characteristic of SQL injection exploitation, enabling practitioners to identify compromised sessions and suspicious admin panel access before databases are breached.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2018-25410.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2018-25410

Casky has 301 skills that investigate the attack patterns behind CVE-2018-25410. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn