PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-25388 Sitejo CVE debrief

CVE-2018-25388 documents an arbitrary file upload vulnerability in HaPe PKH version 1.1, a PHP-based application. The vulnerability allows authenticated attackers to bypass file type validation and upload malicious files, including PHP scripts, through multiple endpoints: aksi_foto.php, aksi_user.php, and aksi_kecamatan.php. Successful exploitation enables remote code execution on the affected server. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no required privileges beyond authentication, and high impacts to confidentiality, integrity, and availability. The CVE was published to NVD on May 29, 2026, with status 'Deferred'. Multiple source references are available including an Exploit-DB entry and a VulnCheck advisory.

Vendor
Sitejo
Product
HaPe PKH
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-05-29
Advisory published
2026-05-29
Advisory updated
2026-05-29

Who should care

Organizations running HaPe PKH 1.1 for PKH (Program Keluarga Harapan) management; system administrators maintaining legacy PHP applications; security teams monitoring for web application vulnerabilities; incident responders investigating potential compromises of PHP-based government social program management systems

Technical summary

HaPe PKH 1.1 fails to properly validate file types during upload operations, allowing authenticated users to upload PHP files through at least three endpoints (aksi_foto.php, aksi_user.php, aksi_kecamatan.php). The insufficient validation permits bypass of intended restrictions, resulting in arbitrary PHP code execution on the server. The vulnerability is remotely exploitable by any authenticated user without additional interaction requirements.

Defensive priority

HIGH

Recommended defensive actions

  • Restrict or disable access to aksi_foto.php, aksi_user.php, and aksi_kecamatan.php endpoints if HaPe PKH 1.1 is in use
  • Implement strict server-side file type validation using whitelist approach for allowed extensions and MIME types
  • Configure web server to deny execution of PHP files in upload directories
  • Remove or rename upload directories to prevent direct web access
  • Apply principle of least privilege to application accounts
  • Consider Web Application Firewall (WAF) rules to detect and block malicious file upload attempts
  • Upgrade to a patched version of HaPe PKH if available, or migrate to alternative software
  • Review and audit existing file uploads for unauthorized PHP files if compromise is suspected

Evidence notes

Vulnerability affects HaPe PKH 1.1 specifically. Attack requires authenticated access. Multiple upload endpoints identified. PHP file execution confirmed as impact. CVSS 4.0 scoring applied. NVD status is 'Deferred' indicating potential incomplete analysis.

Official resources

2026-05-29T16:16:17.990Z