CVE-2018-25387

Vulnerability

HaPe PKH version 1.1 contains a cross-site request forgery (CSRF) vulnerability in the aksi_user.php script. The endpoint admin/modul/mod_user/aksi_user.php?module=user&act=update accepts POST requests without any anti-CSRF token or origin validation. An attacker can craft a form with parameters id_user, password, and level to update the administrator account without needing any prior authentication or authorization [2][3]. The application is based on PHP and uses a SQL database, as described on its SourceForge project page [1].

Exploitation

An attacker only needs to trick an authenticated administrator into visiting a malicious page or submitting a crafted form while the admin's session is active. No additional network position or authentication is required because the vulnerable endpoint does not verify the request origin or enforce any session-based token [2]. The PoC demonstrates a simple HTML form that automatically submits a POST request to the target URL with attacker-controlled values for id_user (set to 1 for the admin), password, and level [2].

Impact

Successful exploitation allows the attacker to change the administrator password, thereby gaining full administrative control over the HaPe PKH application. This leads to complete compromise of the application's confidentiality, integrity, and availability, as the attacker can then manage all users, data, and settings [2][3].

Mitigation

No official patch or fixed version has been released by the vendor. The project's SourceForge page indicates it is at version 1.0 and further development is planned, but no update addressing this CSRF issue is available as of the publication date [1]. The recommended workaround is to implement anti-CSRF tokens in all state-changing requests and validate the Referer header. Until a patch is provided, administrators should review active sessions and avoid clicking untrusted links while logged in [3].