The eNdonesia Portal 8.7 has multiple SQL injection flaws in the mod.php script that allow unauthenticated users to craft malicious input. By inserting SQL code into the artid, cid, did, contid, and aboutid parameters across several modules, an attacker can run arbitrary queries against the database. This capability permits extraction of sensitive information such as usernames, database names, and server version details, compromising confidentiality and potentially integrity if the injected queries modify the data.

Endonesia’s eNdonesia Portal version 8.7 is vulnerable. The flaw resides in the publicly accessible mod.php endpoint, affecting the publisher, diskusi, galeri, content, and about modules via the listed parameters.

With a CVSS vector of 8.8, the flaw is considered high severity. Because the EPSS score is not available, the precise exploitation probability is unknown; however, the vulnerability is publicly documented in Exploit‑DB and is not in the CISA KEV catalog. The attack vector is clear: unauthenticated HTTP requests to mod.php with crafted parameter values. The impact extends to all users of the portal and compromises data stored in the database.