CVE-2018-25392

MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries through the nomor, user, and jenis parameters in the log_activity function. Attackers can send POST requests to /index.php/user/log_activity with malicious SQL code in these parameters to extract sensitive database information including version and database names.

Score

CVSS 4.0 7.1 High

Status

Deferred - disclosure@vulncheck.com

Published

2026-05-29

Last modified

2026-06-02

Weaknesses

CWE-89

Affected products

• Maxon (Maxonerp)

References

• http://demo.maxonerp.com/
• http://www.talagasoft.com
• https://www.exploit-db.com/exploits/45605
• https://www.vulncheck.com/advisories/maxon-erp-software-8-x-9-x-sql-injection-via-nomor-parameter