CVE-2018-25387
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint. Attackers can craft malicious forms targeting the aksi_user.php script with parameters like id_user, password, and level to modify admin credentials without authentication.
Risk Assessment
The risk is a complete takeover of the administrator account, potentially leading to unauthorized system and data access.
Recommendation
Immediately upgrade HaPe PKH to a version newer than 1.1 and implement CSRF protections (e.g., synchronizer tokens) on all data-modifying endpoints.
Other vulnerabilities in HaPe PKH
See all- CVE-2018-25391High
A vulnerability in HaPe PKH 1.1 allows unauthenticated attackers to delete arbitrary records by sending a crafted request specifying the target record's ID. The endpoints admin/modul/mod_pengurus/aksi_pengurus.php and admin/modul/mod_update/aksi_update.php do not verify privileges before performing deletion operations.
- CVE-2018-25390High
An SQL injection vulnerability in HaPe PKH 1.1 allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'desa' POST parameter sent to lap-peserta-perdesa-pdf.php. Attackers can send a crafted request with a time-based blind payload to infer and extract sensitive database information.
- CVE-2018-25389High
An SQL injection vulnerability in HaPe PKH 1.1 allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'nama_kelompok' POST parameter sent to lap-anggota-kelompok-pdf.php. Attackers can send a crafted request with a time-based blind payload to infer and extract sensitive database information.
- CVE-2018-25388High
HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to bypass file type validation and upload malicious files. Through endpoints aksi_foto.php, aksi_user.php, and aksi_kecamatan.php, they can upload PHP files and execute arbitrary code on the server.
- CVE-2018-25386High
HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php that allow attackers to manipulate database queries via the 'id' parameter. An unauthenticated attacker can exploit the desa module, while authenticated users can exploit pengurus, fasilitas, and kelompok modules, leading to extraction of sensitive data such as current user, database name, and DBMS version.
Original NVD description (English source)
HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint. Attackers can craft malicious forms targeting the aksi_user.php script with parameters like id_user, password, and level to modify admin credentials without authentication.