eNdonesia Portal SQL Injection Vulnerability

Multiple SQL injection vulnerabilities have been identified in eNdonesia Portal version 8.7. These vulnerabilities allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through various parameters in mod.php. The affected parameters include artid, cid, did, contid, and aboutid, across several modules such as publisher, diskusi, galeri, content, and about. Exploitation of these vulnerabilities could lead to unauthorized access to database information, including usernames, database names, and version details.

Impact

Successful exploitation allows for arbitrary SQL query execution, potentially leading to unauthorized data access or manipulation.