An SQL injection flaw exists in the id_partai parameter of monitor_nilai.php, allowing attackers to supply crafted SQL code without needing authentication. The flaw lets attackers run arbitrary SQL queries, revealing sensitive database contents such as administrator credentials and user data. The exposed information can lead to credential compromise, user impersonation, and further attacks that leverage the stolen data, resulting in a confidentiality breach and potential integrity violations.

The vulnerability affects the 'E-Registrasi Pencak Silat' application version 18.10. The specific CPE indicates that any deployment of this version of the registrasi-kejuaraan-silat product is at risk. No version range was provided beyond the listed 18.10 release.

The CVSS score of 8.8 denotes a high severity vulnerability. Exploitation requires only remote access via HTTP GET requests to the monitor_nilai.php endpoint, as the attacker does not need prior authentication. The EPSS score is not available, so the current exploitation probability is unknown, but the high CVSS indicates significant risk. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet, however the potential impact remains substantial due to unauthorized data access.