# CVE-2018-25391: HaPe PKH missing authorization in record deletion endpoints

Source: https://junglewise.ai/threats/cve-2018-25391-hape-pkh-missing-authorization-in-record-deletion-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2018-25391 · Severity: high · CVSS 7.5 · Published 2026-05-29

HaPe PKH is a web-based application used for managing social assistance program data. A security flaw in the software allows anyone on the internet to delete administrative and update records without needing a password. This could lead to significant data loss and disruption of the program's management operations.

## Quick answers

**Is CVE-2018-25391 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-25391 being exploited in the wild.

**How severe is CVE-2018-25391?** High severity, with a CVSS score of 7.5, published 29 May 2026.

**Which products and versions are affected?** HaPe PKH Project 1.1 and earlier.

**Is there a fix for CVE-2018-25391?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2018-25391 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2018-25391?** Check whether you run HaPe PKH Project at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in HaPe PKH version 1.1 and earlier. The application fails to verify user privileges on specific administrative endpoints, specifically 'admin/modul/mod_pengurus/aksi_pengurus.php' and 'admin/modul/mod_update/aksi_update.php'. An unauthenticated remote attacker can exploit this by sending a direct HTTP request with the 'act=hapus' parameter and a target 'id'. This allows for the unauthorized deletion of 'pengurus' (administrator) and 'update' records. No user interaction or prior authentication is required for a successful exploit.

## Affected products

- HaPe PKH Project HaPe PKH 1.1 and earlier

## Timeline

- 2018-10-12: disclosed: Initial exploit code published on Exploit-DB
- 2026-05-29: advisory: CVE-2018-25391 published by VulnCheck

## References

- [http://www.sitejo.id/](http://www.sitejo.id/)
- [https://sourceforge.net/projects/hape-pkh/files/latest/download](https://sourceforge.net/projects/hape-pkh/files/latest/download)
- [https://www.exploit-db.com/exploits/45588](https://www.exploit-db.com/exploits/45588)
- [https://www.vulncheck.com/advisories/hape-pkh-missing-authorization-allows-unauthenticated-record-deletion](https://www.vulncheck.com/advisories/hape-pkh-missing-authorization-allows-unauthenticated-record-deletion)

## Related threats

- [HaPe PKH SQL injection in lap-peserta-perdesa-pdf.php](https://junglewise.ai/threats/cve-2018-25390-hape-pkh-sql-injection-in-lap-peserta-perdesa-pdf-php)