CVE-2018-25388: HaPe PKH 1.1 Arbitrary File Upload Vulnerability (CVSS 8.8)

Technical summary

CVE-2018-25388 is an authenticated arbitrary file upload vulnerability in HaPe PKH 1.1 stemming from insufficient file type validation (CWE-434). The vulnerability exists across multiple upload endpoints: aksi_foto.php, aksi_user.php, and aksi_kecamatan.php. Attackers can craft requests that bypass content-type and extension checks to upload PHP files, which the web server will execute with the privileges of the application. The lack of proper file type verification, likely reliant on client-side validation or easily-spoofed MIME-type headers, enables remote code execution once authentication is achieved.

Business impact

Successful exploitation grants an authenticated attacker complete remote code execution on the affected server, allowing them to read sensitive data, modify application logic, deploy malware, establish persistence, or pivot to other systems on the network. In multi-tenant or shared hosting environments, this could lead to lateral movement. Organizations relying on HaPe PKH 1.1 for administrative functions face risk to confidentiality, integrity, and availability of their data and services. The severity is amplified if administrative accounts are compromised or if user credentials are weak or shared.

Affected systems

This vulnerability affects HaPe PKH version 1.1. The vendor_products array in the source data is empty, indicating either that the product identifier was not formally registered in the CVE record or that the vendor has not publicly claimed it. Organizations should verify whether they are running HaPe PKH 1.1 or later versions by checking application version strings and consulting vendor advisories to determine which versions remain affected.

Exploitability

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-exploitable vulnerability requiring valid authentication (PR:L), no user interaction, and high impact across confidentiality, integrity, and availability. Exploitability is moderate—an attacker needs valid credentials but no special privileges. The file upload interface is typically accessible to authenticated administrative or user roles, making the barrier to exploitation low for insider threats or account compromise scenarios. No public exploit code or active exploitation data is available in known exploit databases at this time.

Remediation

Organizations using HaPe PKH 1.1 should prioritize upgrading to the latest patched version available from the vendor. Verify the exact version available and any breaking changes before deployment. Pending patching, implement compensating controls: restrict file upload functionality to trusted administrative users only, disable PHP execution in upload directories via web server configuration (.htaccess or nginx rules), and enforce strict file type validation on both client and server sides using whitelisting (not blacklisting). Monitor upload logs for suspicious activity.

Patch guidance

Contact the HaPe PKH vendor or check their official advisory channels for available patches. Given the published date of May 2026 and modification date of June 2026, patch releases may have already been issued. Verify the current version by checking the application's version information under administration settings or in the application files. Test patches in a non-production environment before rolling out to ensure compatibility with your deployment. If no vendor patch is available, escalate the matter to the vendor with a report of this CVE.

Detection guidance

Monitor for suspicious file uploads to the vulnerable endpoints (aksi_foto.php, aksi_user.php, aksi_kecamatan.php), especially uploads with PHP extensions or double extensions (e.g., file.php.jpg). Review web server access logs for POST requests to these endpoints from authenticated users, correlating with unusual process execution (php process spawning unusual child processes). Check upload directories for recently-created PHP files or files with mismatched MIME types. Implement file integrity monitoring on the upload directories. Enable verbose logging on authentication events to detect compromised accounts.

Why prioritize this

This vulnerability merits immediate attention because it enables unauthenticated remote code execution via a post-authentication bypass, affecting all three CIA pillars. The CVSS score of 8.8 reflects high severity. While authentication is required, the barrier is low; compromised user accounts, insider threats, or weak credential management significantly increase risk. HaPe PKH 1.1 appears to be legacy software with limited visibility in public databases, suggesting it may be deployed in smaller or regional deployments where patching cycles are slower.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH severity, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network accessibility (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction needed (UI:N), and unrestricted scope with complete impact to confidentiality, integrity, and availability (C:H/I:H/A:H). The primary limiting factor is the requirement for authentication; however, this does not substantially reduce risk in environments where credentials are frequently compromised or reused.

Frequently asked questions