This vulnerability is a classic SQL injection flaw in the eNdonesia Portal 8.7 application. The flaw allows an unauthenticated attacker to inject malicious SQL code through five distinct parameters—artid, cid, did, contid, and aboutid—in the mod.php file. By manipulating these inputs, an attacker can execute arbitrary queries against the underlying database, retrieving sensitive information such as usernames, database names, and version details. The impact is primarily the compromise of confidentiality and the potential for further exploitation if the attacker can gain more privileged access.

The affected product is eNdonesia Portal 8.7, distributed by the Endonesia organization. No specific patch or upgrade version is publicly listed; affected installations process requests via mod.php without proper sanitization. Any deployment of this version that exposes mod.php to the internet is at risk.

The CVSS score of 8.8 indicates a high severity, and the lack of a KEV listing suggests it is not currently exploited in the wild, but the flaw remains trivially exploitable due to the absence of authentication and the use of unsanitized parameters. The attacker can simply send crafted HTTP requests to the vulnerable endpoints. Without a patch, the risk is ongoing and the attack surface remains fully exposed.