CVE-2018-25409 Overview
CVE-2018-25409 is an arbitrary file upload vulnerability in SIM-PKH 2.4.1, a PHP-based information system. Authenticated attackers can upload PHP files through the fupload parameter of the aksi_pengurus.php endpoint when invoked with module=pengurus and act=update. The uploaded files land in the foto directory and execute as web scripts, giving attackers code execution under the web server context. The flaw is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type).
Critical Impact
Authenticated attackers can achieve remote code execution by uploading PHP shells through the fupload parameter, leading to full compromise of the host web application.
Affected Products
- SIM-PKH 2.4.1
- Earlier SIM-PKH releases that share the aksi_pengurus.php upload handler
- Deployments using the unmodified foto upload directory
Discovery Timeline
- 2026-05-30 - CVE-2018-25409 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2018-25409
Vulnerability Analysis
The vulnerability resides in the aksi_pengurus.php action handler. When called with module=pengurus and act=update, the script accepts the fupload file parameter without validating the file extension, MIME type, or content. The handler writes the submitted file into the foto directory, which is served by the web server and parsed by the PHP interpreter. An attacker with a valid authenticated session can upload a .php payload and then request it directly to trigger execution. Because the foto directory is exposed for profile photos, no additional path manipulation is required.
Root Cause
The upload handler enforces no allowlist of permitted file types and performs no server-side content inspection. SIM-PKH trusts client-supplied filenames and writes them directly into a directory that the web server treats as executable PHP. This is a textbook unrestricted file upload weakness under CWE-434.
Attack Vector
Exploitation requires network access to the SIM-PKH application and valid credentials with permission to submit the pengurus update form. The attacker submits a multipart POST request to aksi_pengurus.php containing PHP code in the fupload field. After upload, the attacker issues a GET request to the resulting file in the foto directory to execute arbitrary commands. Technical details and a working proof of concept are documented in Exploit-DB #45659 and the VulnCheck Advisory on Sim-PKH.
Detection Methods for CVE-2018-25409
Indicators of Compromise
- New .php, .phtml, or .phar files appearing inside the foto directory of the SIM-PKH install.
- Web server access logs showing POST requests to aksi_pengurus.php with module=pengurus&act=update followed by GET requests to files under /foto/.
- Outbound network connections from the PHP worker process to unexpected hosts following an upload event.
Detection Strategies
- Inspect HTTP request bodies for multipart/form-data submissions to aksi_pengurus.php whose fupload filename ends in a script extension.
- Alert on file creation events in the foto directory where the file magic bytes do not match an image format.
- Correlate authenticated session activity with creation of executable content in web-served directories.
Monitoring Recommendations
- Forward web server and PHP-FPM logs to a centralized SIEM and retain access logs for aksi_pengurus.php.
- Monitor file integrity on the SIM-PKH document root, with focus on the foto upload path.
- Track process lineage from the PHP interpreter for spawned shells, curl, wget, or compiler invocations that indicate post-exploitation.
How to Mitigate CVE-2018-25409
Immediate Actions Required
- Restrict access to the SIM-PKH administrative interface to trusted networks and rotate credentials of all pengurus accounts.
- Remove any unexpected PHP files from the foto directory and verify no persistence has been added elsewhere in the webroot.
- Place a web application firewall rule in front of aksi_pengurus.php to block uploads whose filename ends in PHP-handled extensions.
Patch Information
No vendor patch is referenced in the NVD entry. Refer to the SimpKH Project Home and SimpKH Latest Download for the latest available release, and consult the VulnCheck Advisory on Sim-PKH for remediation status.
Workarounds
- Configure the web server to deny PHP execution within the foto directory using an Apache .htaccess rule or an Nginx location block.
- Enforce a server-side allowlist that permits only image MIME types and rewrites filenames to non-executable extensions before storage.
- Move user uploads outside the webroot and serve them through a read-only download script that sets a static Content-Type.
# Apache: deny PHP execution inside the foto upload directory
# Place in /path/to/simpkh/foto/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
Require all denied
</FilesMatch>
php_flag engine off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
