HaPe PKH 1.1 contains a SQL injection flaw in the id parameter of admin/media.php. This flaw is a classic input validation issue described by CWE-89 and allows attackers to execute arbitrary SQL statements against the underlying database. The attack can disclose even sensitive internal information such as the current user, database name, and the database management system version.

The vulnerability exists in the Sitejo Hub HaPe PKH 1.1 product. The insecure admin/media.php file is used by the desa module and by authenticated modules such as pengurus, fasilitas, and kelompok. Unauthenticated users can trigger the flaw via the desa module, while authenticated users can exploit it in the other modules.

The CVSS score of 8.8 indicates a high severity and the vulnerability is publicly known though no EPSS data was returned, so the exploitation probability is unspecified. The flaw is in a web exposed input parameter and does not require special privileges, meaning that an attacker can exploit it from any network that can reach the application. The vulnerability is not listed in CISA's KEV catalog, but the absence of mitigation does not lower its risk, especially because a subset of the attack surface is fully unauthenticated.