A critical SQL injection vulnerability in eNdonesia Portal version 8.7 allows unauthenticated remote attackers to extract sensitive database information, posing a significant risk to data confidentiality.

The application fails to properly neutralize special elements used in SQL commands within the banners.php, user.php, and admin.php files. This allows an unauthenticated attacker to inject malicious SQL payloads via parameters such as bid or email to manipulate database queries.

The ability for an unauthenticated attacker to execute arbitrary SQL queries against the backend database represents a severe security risk. This could lead to the total compromise of sensitive user data, administrative credentials, or configuration details, potentially resulting in complete system takeover or long term data exfiltration. With a CVSS score of 8.2, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized access.

Immediate Action: As no official patch is currently available for this legacy software, administrators must restrict access to the affected scripts or take the application offline until a secure alternative is implemented.

Proactive Monitoring: Security teams should monitor web access logs for unusual GET or POST requests containing SQL syntax, such as UNION, SELECT, or sleep commands, directed at the portal.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules configured to block malicious patterns targeting the bid and email parameters.

Public Exploit Available: Yes, a published proof-of-concept exists in an ExploitDB entry (EDB-ID: 46559) detailing the exact attack vectors.

Given the availability of public exploit code and the critical nature of SQL injection, the risk to environments running eNdonesia Portal 8.7 is substantial. Organizations currently using this software are strongly advised to migrate to a modern, supported content management system, as the lack of vendor-provided patches leaves the application permanently vulnerable to exploitation.