CVE-2018-25392: MaxOn ERP Software 8.x-9.x SQL Injection via nomor Parameter

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-29 · updated 2026-07-21
Weakness: CWE-89

Description

MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries through the nomor, user, and jenis parameters in the log_activity function. Attackers can send POST requests to /index.php/user/log_activity with malicious SQL code in these parameters to extract sensitive database information including version and database names.

Affected products

Talagasoft MaxOn ERP: 8.0, 9.0

References

http://demo.maxonerp.com/
http://www.talagasoft.com
https://www.exploit-db.com/exploits/45605
https://www.vulncheck.com/advisories/maxon-erp-software-8-x-9-x-sql-injection-via-nomor-parameter

Get alerted when CVE-2018-25392 or the next vulnerability affects your stack