An SQL injection flaw exists in the log_activity function of MaxOn ERP Software 8.x-9.x, allowing an authenticated user to inject arbitrary SQL code via the nomor, user, and jenis parameters. By sending crafted POST requests to /index.php/user/log_activity, the attacker can retrieve sensitive database information such as the database name and version, potentially escalating to full data exfiltration. The weakness aligns with CWE-89 and represents a typical insider or authenticated threat vector.

The vulnerability affects Talagasoft MaxOn ERP versions 8.x and 9.x. Organizations running these ERP editions are impacted.

The CVSS score of 7.1 indicates a moderate to high severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting that while the risk is significant, it may not yet be actively exploited in the wild. The attack requires valid credentials to reach the vulnerable endpoint, so the primary exploitation path is an authenticated user commandeering the log_activity function.