SIM-PKH 2.4.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by submitting PHP code through the f…

SIM-PKH version 2.4.1 contains a critical arbitrary file upload vulnerability that allows authenticated attackers to upload and execute malicious PHP files. The vulnerability exists in the aksi_pengurus.php endpoint through the fupload parameter with specific module and action parameters. Attackers can upload PHP code that gets stored in the foto directory and executed as web scripts, leading to potential remote code execution. This vulnerability affects the SIM-PKH application and has been documented with proof-of-concept exploits available on Exploit-DB.