CVE-2018-25388
HaPe PKH 1.1 Arbitrary File Upload via aksi_foto.php
- State
- Published
- Severity
- 8.7 High
- Published
- May 29, 2026
- Updated
- May 29, 2026
- Reserved
- May 29, 2026
Description
HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by bypassing file type validation. Attackers can upload PHP files through multiple endpoints including aksi_foto.php, aksi_user.php, and aksi_kecamatan.php to execute arbitrary code on the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
HaPe PKHSitejo |
|
References
- ExploitDB-45593exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: HaPe PKH 1.1 Arbitrary File Upload via aksi_foto.phpthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.