Vulnerability details

CVE-2018-25391

Sitejo HaPe PKH

HaPe PKH 1.1 Missing Authorization Allows Unauthenticated Record Deletion

CVSS 4.0

8.7High

Official description

HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that specifies the target record's id. The admin/modul/mod_pengurus/aksi_pengurus.php (module=pengurus&act=hapus) and admin/modul/mod_update/aksi_update.php (module=update&act=hapus) endpoints process deletions without verifying the requester's privileges, enabling removal of pengurus (administrator) and update records.

CVSS scores

Score	Version	Source	Vector
8.7High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N`
7.5High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
Sitejo	HaPe PKH	1.1	CVEProject cvelistV5 (CNA)

References and advisories

https://www.exploit-db.com/exploits/45588 exploit
http://www.sitejo.id product
https://sourceforge.net/projects/hape-pkh/files/latest/download product
https://www.vulncheck.com/advisories/hape-pkh-missing-authorization-allows-unauthenticated-record-deletion third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-05-29
Last updated: 2026-05-29
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.33%

Probability of exploitation in 30 days

26.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-862
Missing Authorization