HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by bypassing file type validation. At…

HaPe PKH version 1.1 contains a critical arbitrary file upload vulnerability that allows authenticated attackers to bypass file type validation and upload malicious PHP files. The vulnerability affects multiple endpoints including aksi_foto.php, aksi_user.php, and aksi_kecamatan.php, enabling attackers to execute arbitrary code on the server. This represents a significant security risk as it can lead to complete server compromise through remote code execution. The vulnerability has been documented with CVE-2018-25388 and exploit code is publicly available.