HaPe PKH SQL Injection Vulnerability

A SQL injection vulnerability has been identified in HaPe PKH version 1.1. This vulnerability allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'desa' POST parameter, which is sent to the 'lap-peserta-perdesa-pdf.php' file. Exploitation of this vulnerability can lead to the extraction of sensitive database information.

Impact

Exploitation of this vulnerability allows for arbitrary SQL code execution, which can be used to manipulate the database or extract sensitive information.

Reproduction

To reproduce this vulnerability, send a POST request to 'lap-peserta-perdesa-pdf.php' with a crafted payload in the 'desa' parameter that exploits the SQL injection. The payload can be designed to perform a time-based blind SQL injection, allowing the attacker to infer and extract database information.