HaPe PKH vulnerabilities

A vulnerability in HaPe PKH 1.1 allows unauthenticated attackers to delete arbitrary records by sending a crafted request specifying the target record's ID. The endpoints admin/modul/mod_pengurus/aksi_pengurus.php and admin/modul/mod_update/aksi_update.php do not verify privileges before performing deletion operations.

An SQL injection vulnerability in HaPe PKH 1.1 allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'desa' POST parameter sent to lap-peserta-perdesa-pdf.php. Attackers can send a crafted request with a time-based blind payload to infer and extract sensitive database information.

An SQL injection vulnerability in HaPe PKH 1.1 allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'nama_kelompok' POST parameter sent to lap-anggota-kelompok-pdf.php. Attackers can send a crafted request with a time-based blind payload to infer and extract sensitive database information.

HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to bypass file type validation and upload malicious files. Through endpoints aksi_foto.php, aksi_user.php, and aksi_kecamatan.php, they can upload PHP files and execute arbitrary code on the server.

HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint. Attackers can craft malicious forms targeting the aksi_user.php script with parameters like id_user, password, and level to modify admin credentials without authentication.

HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php that allow attackers to manipulate database queries via the 'id' parameter. An unauthenticated attacker can exploit the desa module, while authenticated users can exploit pengurus, fasilitas, and kelompok modules, leading to extraction of sensitive data such as current user, database name, and DBMS version.