CVE-2018-25409
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
SIM-PKH 2.4.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by submitting PHP code through the fupload parameter. Attackers can upload PHP files via the aksi_pengurus.php endpoint with module=pengurus and act=update parameters, which are stored in the foto directory and executed as web scripts.
Risk Assessment
An attacker can achieve remote code execution on the server, leading to full system compromise and potential takeover of the application.
Recommendation
Immediately update SIM-PKH to the latest version that fixes this vulnerability, and restrict the ability to upload PHP files in the foto directory.
Other vulnerabilities in SIM-PKH
Original NVD description (English source)
SIM-PKH 2.4.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by submitting PHP code through the fupload parameter. Attackers can upload PHP files via the aksi_pengurus.php endpoint with module=pengurus and act=update parameters, which are stored in the foto directory and executed as web scripts.