HaPe PKH 1.1 contains an embedded SQL injection flaw that can be triggered by submitting a crafted POST payload to the "nama_kelompok" parameter. Attackers able to send requests to lap-anggota-kelompok-pdf.php can inject arbitrary SQL, including time-based blind predicates, allowing them to read, manipulate, or delete database contents. The vulnerability enables persistent data compromise without authentication.

The vulnerable implementation is found in the Sitejo HaPe PKH web application, specifically version 1.1. No other variant or upstream product has been identified as affected in the current advisory.

The CVSS score of 8.8 indicates a high‑severity flaw that could lead to full database compromise. The EPSS score is unavailable, but the lack of a KEV listing suggests limited evidence of exploitation in the wild. The likely attack vector is over the network, with the attacker needing only access to the web application’s public endpoint. Once the application is reachable, an unauthenticated attacker can execute the injected SQL and exfiltrate data.