CVE-2018-25391: HaPe PKH Auth Bypass Vulnerability

CVE-2018-25391 Overview

CVE-2018-25391 is a missing authorization vulnerability [CWE-862] in HaPe PKH 1.1, a PHP-based web application distributed via SourceForge. The flaw allows unauthenticated remote attackers to delete arbitrary administrator (pengurus) and update records by sending crafted HTTP requests. Two endpoints fail to validate the requester's session or privileges before processing record deletions: admin/modul/mod_pengurus/aksi_pengurus.php and admin/modul/mod_update/aksi_update.php. Both endpoints accept an id parameter and execute the deletion regardless of authentication state. Public exploit code is available on Exploit-DB as entry 45588.

Critical Impact
Unauthenticated attackers can permanently remove administrator accounts and update records, breaking application integrity and enabling denial of service against legitimate administrators.

Affected Products

HaPe PKH version 1.1
Distributed via SourceForge hape-pkh project
Vendor reference site: Sitejo (sitejo.id)

Discovery Timeline

2026-05-29 - CVE-2018-25391 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2018-25391

Vulnerability Analysis

The vulnerability is a broken access control flaw classified under [CWE-862] Missing Authorization. HaPe PKH 1.1 exposes two administrative deletion endpoints that do not verify whether the HTTP requester is authenticated or holds an administrative role. Any client able to reach the application over the network can issue the deletion request and remove records by ID.

The attack targets two specific PHP scripts. The first, admin/modul/mod_pengurus/aksi_pengurus.php invoked with module=pengurus&act=hapus, removes administrator (pengurus) records. The second, admin/modul/mod_update/aksi_update.php invoked with module=update&act=hapus, removes update records. The Indonesian word hapus means "delete", and aksi means "action".

Impact is limited to integrity loss: an attacker can destroy data but cannot read confidential records or directly execute code through this flaw alone. Deletion of the primary administrator record can lock out legitimate operators and enable follow-on takeover if combined with other weaknesses.

Root Cause

The deletion scripts dispatch on module and act query parameters and call backend deletion logic without first checking session state or user role. There is no server-side authorization gate, and the endpoints are reachable on the network surface of the admin module without prior login enforcement.

Attack Vector

Exploitation requires only network access to the vulnerable application. An attacker issues an HTTP request to the affected endpoint with the target record id. No credentials, user interaction, or special conditions are needed. Technical details are documented in the Exploit-DB #45588 entry and the VulnCheck advisory.

Detection Methods for CVE-2018-25391

Indicators of Compromise

HTTP requests to admin/modul/mod_pengurus/aksi_pengurus.php containing module=pengurus&act=hapus from unauthenticated sessions.
HTTP requests to admin/modul/mod_update/aksi_update.php containing module=update&act=hapus without a valid admin session cookie.
Unexpected loss of administrator accounts or update entries in the application database.
Web server access logs showing deletion endpoint hits from external IP addresses outside expected admin networks.

Detection Strategies

Alert on any access to the two deletion endpoints that lacks a prior authenticated session token in the same source IP context.
Correlate database DELETE statements against pengurus and update tables with the originating web session and HTTP request.
Deploy WAF rules that match the vulnerable URI patterns and block requests that do not carry valid admin session cookies.

Monitoring Recommendations

Enable verbose access logging on the admin/ directory and forward logs to a centralized analytics platform for retention and review.
Audit administrator and update record counts on a recurring schedule and alert on sudden decreases.
Monitor outbound traffic from web servers for reconnaissance scanners targeting PHP admin paths.

How to Mitigate CVE-2018-25391

Immediate Actions Required

Restrict network access to the admin/ directory using firewall rules, IP allow-lists, or VPN-only access until the application is remediated.
Add server-side authentication and authorization checks at the top of aksi_pengurus.php and aksi_update.php to validate session state and admin role before processing act=hapus.
Back up the application database and verify the integrity of pengurus and update records to confirm no unauthorized deletions have occurred.
Consider migrating off HaPe PKH 1.1 given the absence of an upstream vendor patch.

Patch Information

No vendor-supplied patch is referenced in the NVD entry or the VulnCheck advisory. Operators must apply application-level code changes to enforce authorization, or decommission the affected installation.

Workarounds

Place the admin module behind HTTP Basic Authentication or a reverse proxy that enforces authentication before any PHP script executes.
Add a session validation include at the top of every script in admin/modul/ that aborts the request when no authenticated admin session exists.
Deploy a web application firewall rule blocking unauthenticated requests containing act=hapus to the affected endpoints.

bash

# Example nginx configuration restricting the admin module to a trusted network
location /admin/ {
    allow 10.0.0.0/8;
    deny all;
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
}