Executive brief
SIM-PKH, a web-based application used for managing social assistance program data, contains a security flaw in its file upload functionality. An authorized user can upload a malicious script disguised as a photo, which the server then executes. This allows an attacker to take full control of the web server, potentially leading to the theft of sensitive participant data or a complete service shutdown.
Technical details
An unrestricted file upload vulnerability (CWE-434) exists in SIM-PKH version 2.4.1. The flaw is located in the 'aksi_pengurus.php' endpoint, specifically when processing the 'fupload' parameter with 'module=pengurus' and 'act=update'. The application fails to properly validate file extensions or content types, allowing an authenticated attacker to upload PHP files to the '/foto/' directory. Because these files are stored within the web root and the server is configured to execute PHP, an attacker can achieve remote code execution (RCE) by accessing the uploaded file. This project is reportedly discontinued and replaced by HaPe-PKH, so a formal patch may not be available.
Affected products
- SIM-PKH Project SIM-PKH 2.4.1
Timeline
- 2018-10-22: disclosed: Initial vulnerability discovery and exploit publication by Ihsan Sencan
- 2026-05-30: advisory: CVE-2018-25409 published and enriched by VulnCheck/NVD