Executive brief
HaPe PKH, a web-based application used for managing social assistance data, contains a security flaw that allows unauthorized individuals to change administrator passwords. By tricking a logged-in user into visiting a malicious website or clicking a link, an attacker can take over administrative accounts. This could lead to unauthorized access to sensitive participant data and disruption of social service operations.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in HaPe PKH version 1.1 due to a lack of anti-CSRF tokens or validation on sensitive state-changing requests. The vulnerability is located in the 'aksi_user.php' script, specifically when the 'act' parameter is set to 'update'. An unauthenticated remote attacker can exploit this by crafting a malicious HTML form that targets this endpoint with parameters such as 'id_user', 'password', and 'level'. If an authenticated administrator interacts with a malicious page while their session is active, the attacker can successfully modify the administrator's credentials. This vulnerability was originally identified in 2018 and documented via public exploit code.
Affected products
- HaPe PKH HaPe PKH (Harian Pendamping PKH) 1.1
Timeline
- 2018-10-12: disclosed: Exploit-DB entry published by Ihsan Sencan
- 2026-05-29: advisory: CVE record published/updated via VulnCheck