Vulnerability Description
HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by bypassing file type validation. Attackers can upload PHP files through multiple endpoints including aksi_foto.php, aksi_user.php, and aksi_kecamatan.php to execute arbitrary code on the server.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- http://www.sitejo.id
- https://sourceforge.net/projects/hape-pkh/files/latest/download
- https://www.exploit-db.com/exploits/45593
- https://www.vulncheck.com/advisories/hape-pkh-arbitrary-file-upload-via-aksi-fot
FAQ
What is CVE-2018-25388?
CVE-2018-25388 is a vulnerability with a CVSS score of 8.8 (HIGH). HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by bypassing file type validation. Attackers can upload PHP files through mul...
How severe is CVE-2018-25388?
CVE-2018-25388 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-25388?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.