CVE-2018-25388
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to bypass file type validation and upload malicious files. Through endpoints aksi_foto.php, aksi_user.php, and aksi_kecamatan.php, they can upload PHP files and execute arbitrary code on the server.
Risk Assessment
The risk is that an attacker can gain control over the server, potentially leading to data theft, content modification, or further attacks on the infrastructure.
Recommendation
Immediately update HaPe PKH to the latest version, implement strict server-side file type validation, and restrict permissions on target directories.
Other vulnerabilities in HaPe PKH
See all- CVE-2018-25391High
A vulnerability in HaPe PKH 1.1 allows unauthenticated attackers to delete arbitrary records by sending a crafted request specifying the target record's ID. The endpoints admin/modul/mod_pengurus/aksi_pengurus.php and admin/modul/mod_update/aksi_update.php do not verify privileges before performing deletion operations.
- CVE-2018-25390High
An SQL injection vulnerability in HaPe PKH 1.1 allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'desa' POST parameter sent to lap-peserta-perdesa-pdf.php. Attackers can send a crafted request with a time-based blind payload to infer and extract sensitive database information.
- CVE-2018-25389High
An SQL injection vulnerability in HaPe PKH 1.1 allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'nama_kelompok' POST parameter sent to lap-anggota-kelompok-pdf.php. Attackers can send a crafted request with a time-based blind payload to infer and extract sensitive database information.
- CVE-2018-25387Medium
HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint. Attackers can craft malicious forms targeting the aksi_user.php script with parameters like id_user, password, and level to modify admin credentials without authentication.
- CVE-2018-25386High
HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php that allow attackers to manipulate database queries via the 'id' parameter. An unauthenticated attacker can exploit the desa module, while authenticated users can exploit pengurus, fasilitas, and kelompok modules, leading to extraction of sensitive data such as current user, database name, and DBMS version.
Original NVD description (English source)
HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by bypassing file type validation. Attackers can upload PHP files through multiple endpoints including aksi_foto.php, aksi_user.php, and aksi_kecamatan.php to execute arbitrary code on the server.