CVE-2018-25388: HaPe PKH File Upload RCE Vulnerability

CVE-2018-25388 Overview

CVE-2018-25388 is an arbitrary file upload vulnerability in HaPe PKH 1.1, a PHP-based web application distributed through SourceForge. The flaw allows authenticated attackers to bypass file type validation and upload PHP files through multiple endpoints, including aksi_foto.php, aksi_user.php, and aksi_kecamatan.php. Once a malicious file is uploaded, the attacker can execute arbitrary code on the server with the privileges of the web server process. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and carries a CVSS 4.0 score of 8.7.

Critical Impact
Authenticated attackers can achieve remote code execution by uploading PHP webshells through unprotected file upload endpoints in HaPe PKH 1.1.

Affected Products

HaPe PKH version 1.1
Distribution channel: SourceForge HaPe PKH project
Vendor reference: SiteJo

Discovery Timeline

2026-05-29 - CVE-2018-25388 published to the National Vulnerability Database
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2018-25388

Vulnerability Analysis

HaPe PKH 1.1 exposes several file upload handlers that fail to enforce server-side validation of uploaded content. The endpoints aksi_foto.php, aksi_user.php, and aksi_kecamatan.php accept files from authenticated users without checking the file extension, MIME type, or content against an allow list. An attacker with valid application credentials can submit a PHP script disguised as an image or other expected file type. The server stores the file in a web-accessible directory and executes it when the attacker requests its URL. This grants the attacker the ability to run arbitrary PHP code in the context of the web server.

Root Cause

The root cause is missing or incomplete validation in the file upload routines of multiple PHP handlers. The application trusts client-supplied metadata and does not restrict executable file types from being written to a directory served by the web server. This is a classic instance of CWE-434.

Attack Vector

Exploitation requires network access to the application and a valid user account. The attacker sends a crafted multipart HTTP POST request containing a PHP payload to one of the vulnerable endpoints. After the upload succeeds, the attacker requests the uploaded file directly, triggering server-side execution. Public exploitation details are available through Exploit-DB #45593 and the VulnCheck advisory.

Detection Methods for CVE-2018-25388

Indicators of Compromise

Unexpected .php, .phtml, or .phar files appearing in upload directories used by HaPe PKH
HTTP POST requests targeting aksi_foto.php, aksi_user.php, or aksi_kecamatan.php with executable payloads
Web server processes spawning shell interpreters such as /bin/sh, bash, or cmd.exe
Outbound network connections from the web server to unfamiliar hosts following an upload event

Detection Strategies

Monitor web server access logs for POST requests to the three vulnerable endpoints followed by GET requests to newly created files
Inspect uploaded files for PHP tags (<?php, <?=) regardless of declared extension
Alert on file writes by the web server user to directories that should contain only static media

Monitoring Recommendations

Enable file integrity monitoring on directories used by the HaPe PKH application
Forward web server, PHP-FPM, and process execution telemetry to a centralized analytics platform for correlation
Track child process creation from the PHP interpreter to identify webshell activity

How to Mitigate CVE-2018-25388

Immediate Actions Required

Restrict access to HaPe PKH 1.1 from untrusted networks until a fix is applied
Audit upload directories for unauthorized PHP files and remove any webshells found
Rotate credentials for all HaPe PKH user accounts to limit reuse by attackers
Review web server logs for prior exploitation attempts against the affected endpoints

Patch Information

No vendor patch is referenced in the NVD record at the time of publication. Operators should consult the VulnCheck advisory and the upstream project on SourceForge for any updated releases.

Workarounds

Configure the web server to deny execution of PHP files inside upload directories using directives such as php_flag engine off or equivalent location rules
Add server-side validation that rejects any uploaded file whose content begins with PHP tags or whose extension is not in a strict allow list
Place the application behind a web application firewall with rules blocking executable content in multipart uploads
Run the PHP process under a least-privileged account with no write access to web-served paths beyond designated upload locations

bash

# Example nginx configuration to disable PHP execution in upload directories
location ~ ^/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}