PT-2026-44865 · Undefined · Undefined

Published 2026-05-29 · Updated 2026-05-29 · CVE-2018-25387

NVD

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint. Attackers can craft malicious forms targeting the aksi user.php script with parameters like id user, password, and level to modify admin credentials without authentication.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-25387

Affected Products

Undefined

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-25387 · Security Note
• https://exploit-db.com/exploits/45591 · Note
• https://vulncheck.com/advisories/hape-pkh-cross-site-request-forgery-via-aksi-user-php · Note
• https://sourceforge.net/projects/hape-pkh/files/latest/download · Note
• http://sitejo.id · Note