MaxOn ERP Software versions 8.x-9.x contains an SQL injection vulnerability in the log_activity function. Authenticated attackers can exploit the nomor, user, and jenis parameters by sending malicious POST requests to /index.php/user/log_activity. The vulnerability allows execution of arbitrary SQL queries to extract sensitive database information including version details and database names. The flaw affects the log_activity function and can be exploited through parameter manipulation in POST requests.