Exploitation Summary
EIP tracks 1 public exploit for CVE-2018-25388. PoCs published by Ihsan Sencan.
AI-analyzed exploit summary This exploit demonstrates an arbitrary file upload vulnerability in HaPe PKH 1.1 by providing multiple HTML forms that allow uploading malicious PHP files to specific paths on the server. The vulnerability arises due to insufficient file type validation in the upload functionality.
Description
HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by bypassing file type validation. Attackers can upload PHP files through multiple endpoints including aksi_foto.php, aksi_user.php, and aksi_kecamatan.php to execute arbitrary code on the server.
Exploits (1)
This exploit demonstrates an arbitrary file upload vulnerability in HaPe PKH 1.1 by providing multiple HTML forms that allow uploading malicious PHP files to specific paths on the server. The vulnerability arises due to insufficient file type validation in the upload functionality.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H