PT-2026-44865 · Undefined · Undefined

Publicado 2026-05-29 · Atualizado 2026-05-29 · CVE-2018-25387

NVD

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint. Attackers can craft malicious forms targeting the aksi user.php script with parameters like id user, password, and level to modify admin credentials without authentication.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-25387

Produtos afetados

Undefined

Referências · 5

• https://exploit-db.com/exploits/45591 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-25387 · Nota de Segurança
• https://vulncheck.com/advisories/hape-pkh-cross-site-request-forgery-via-aksi-user-php · Nota
• https://sourceforge.net/projects/hape-pkh/files/latest/download · Nota
• http://sitejo.id · Nota