CVE-2018-25388

Vulnerability

HaPe PKH 1.1 suffers from an arbitrary file upload vulnerability [1][3]. The application fails to properly validate file types in multiple endpoints, including aksi_foto.php, aksi_user.php, and aksi_kecamatan.php. This allows authenticated attackers with a valid session to upload PHP files (e.g., Shell.php) instead of the expected image files. The uploaded files are stored in accessible paths such as gambar-konten/ directory, where they become executable. The software version affected is 1.1 (and possibly earlier versions as the project is a continuation of SIM-PKH 2.5) [2].

Exploitation

An attacker must first obtain valid authentication credentials for the admin panel. The exploit requires no special network position beyond normal web access. Exploitation steps involve intercepting the file upload request (e.g., via the form posted to aksi_foto.php) and substituting the file with a PHP shell. As demonstrated in the proof of concept, the attacker can then access the shell via a path like http://localhost/[PATH]/gambar-konten/9Shell.php [1]. Multiple upload endpoints (aksi_foto.php, aksi_user.php, aksi_kecamatan.php) provide alternative vectors.

Impact

Successful exploitation results in arbitrary code execution on the server. The attacker gains the ability to execute PHP commands in the context of the web server, potentially leading to full compromise of the application, modification or exfiltration of data, and further attacks against the underlying system.

Mitigation

As of the available references, no official patch has been released. The vendor homepage (sitejo.id) and the SourceForge project page [2] indicate that further development may occur, but no fixed version is mentioned. In the absence of a patch, administrators should restrict access to the admin panel, implement strong authentication, and apply input validation and file extension whitelisting on all upload endpoints. The CVE is not listed in the KEV catalog.