SIM-PKH 2.4.1 Arbitrary File Upload via aksi_pengurus.php
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.7epss 0.3%
exploitation probability
0.3%top 75% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
SIM-PKH 2.4.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by submitting PHP code through the fupload parameter. Attackers can upload PHP files via the aksi_pengurus.php endpoint with module=pengurus and act=update parameters, which are stored in the foto directory and executed as web scripts.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Simpkh · SIM-PKHpublic PoCs found — 1
cve_referencewww.exploit-db.com/exploits/45659unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.