PT-2026-45109 · Sim-Pkh · Sim-Pkh
CVE-2018-25409
·
Published
2026-05-30
·
Updated
2026-07-22
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SIM-PKH version 2.4.1
Description
An arbitrary file upload issue allows authenticated attackers to upload malicious files by submitting PHP code through the
fupload parameter. This is possible via the 'aksi pengurus.php' endpoint when using the module=pengurus and act=update parameters. The uploaded PHP files are stored in the 'foto' directory and can be executed as web scripts.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sim-Pkh