eNdonesia Portal 8.7 has multiple SQL Injection flaws in the mod.php file that let attackers inject malicious SQL through the artid, cid, did, contid, and aboutid parameters. The flaw allows unauthenticated users to run arbitrary queries and retrieve sensitive information such as database credentials, usernames, and software version details. This type of vulnerability aligns with CWE‑89 and directly threatens the confidentiality of the database contents.

The vulnerability affects Endonesia eNdonesia Portal version 8.7. No other versions are listed as impacted, and there is no indication that earlier releases are affected.

The CVSS score of 8.8 marks it as a high‑severity issue, and while no EPSS value is provided, the absence of a KEV listing does not reduce the inherent risk. The flaw is exploitable over the web; an attacker only needs to access the mod.php endpoint and can send the malicious payload without authentication. Given the ease of exploitation and the potential to harvest credentials, the risk to any deployed instance of the portal is significant.