# CVE-2018-25388: insansutejo HaPe PKH arbitrary file upload

Source: https://junglewise.ai/threats/cve-2018-25388-insansutejo-hape-pkh-arbitrary-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2018-25388 · Severity: high · CVSS 8.8 · Published 2026-05-29

HaPe PKH, a web-based application used for managing social assistance data, contains a security flaw that allows users to upload unauthorized files. An attacker with basic login credentials can bypass security checks to upload and run malicious scripts on the server. This could lead to a complete takeover of the system, allowing the attacker to steal sensitive data or disrupt operations.

Technologies: [Insansutejo HaPe PKH](https://junglewise.ai/threats/technologies/hape-pkh). Vendors: [Insansutejo](https://junglewise.ai/threats/vendors/insansutejo).

## Quick answers

**Is CVE-2018-25388 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-25388 being exploited in the wild.

**How severe is CVE-2018-25388?** High severity, with a CVSS score of 8.8, published 29 May 2026.

**Which products and versions are affected?** Insansutejo HaPe PKH 1.1.

**Is there a fix for CVE-2018-25388?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2018-25388 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2018-25388?** Check whether you run Insansutejo HaPe PKH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unrestricted file upload vulnerability (CWE-434) exists in HaPe PKH version 1.1. The application fails to properly validate file extensions or content types across several administrative endpoints, including aksi_foto.php, aksi_user.php, and aksi_kecamatan.php. An authenticated attacker can exploit this by uploading a PHP shell disguised as an image or through direct POST requests. Once uploaded, the script can be accessed via the web root (typically in the /gambar-konten/ directory), leading to remote code execution (RCE) with the privileges of the web server. No patch is currently documented in the advisory.

## Affected products

- insansutejo HaPe PKH 1.1

## Timeline

- 2018-10-12: disclosed: Exploit published on Exploit-DB
- 2026-05-29: advisory: NVD/VulnCheck advisory published

## References

- [http://www.sitejo.id/](http://www.sitejo.id/)
- [https://sourceforge.net/projects/hape-pkh/files/latest/download](https://sourceforge.net/projects/hape-pkh/files/latest/download)
- [https://www.exploit-db.com/exploits/45593](https://www.exploit-db.com/exploits/45593)
- [https://www.vulncheck.com/advisories/hape-pkh-arbitrary-file-upload-via-aksi-foto-php](https://www.vulncheck.com/advisories/hape-pkh-arbitrary-file-upload-via-aksi-foto-php)

## Related threats

- [HaPe PKH SQL injection in lap-anggota-kelompok-pdf.php](https://junglewise.ai/threats/cve-2018-25389-hape-pkh-sql-injection-in-lap-anggota-kelompok-pdf-php)