An unrestricted file upload vulnerability in the Sitejo HaPe PKH application allows an authenticated attacker to achieve remote code execution.

The application fails to properly validate the types of files uploaded, specifically within the 'aksi-foto.php' component. This allows an authenticated attacker to upload malicious scripts, leading to full system compromise.

An attacker with access to the application can leverage this vulnerability to gain full control over the underlying server. This leads to potential data exfiltration, unauthorized administrative access, and full system takeover. The CVSS score of 8.8 highlights the severity of the potential impact on confidentiality, integrity, and availability.

Immediate Action: Since no official patch is available from the vendor, restrict access to the file upload functionality to trusted users only and implement strict file extension filtering.

Proactive Monitoring: Audit the server's web root and upload directories for suspicious files or unexpected executable scripts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block non-image file uploads and restrict access to administrative PHP scripts.

Public Exploit Available: Yes — a public proof-of-concept is available via VulnCheck and ExploitDB.

Due to the availability of public exploits, this vulnerability poses a significant risk. If the application cannot be updated or secured, it should be removed from service until a permanent fix is implemented.