HaPe PKH 1.1 contains a CSRF vulnerability (CWE‑352) that permits an attacker to modify administrator credentials by sending forged requests to the aksi_user.php endpoint. The flaw allows supply of parameters such as id_user, password, and level without requiring any authentication, thereby enabling attackers to reset admin passwords and gain privileged access. The vulnerability directly compromises confidentiality and integrity of privileged accounts.

The affected product is HaPe PKH version 1.1 from the Sitejo vendor. No additional versions are listed as vulnerable.

The CVSS score of 6.9 classifies the flaw as medium severity, and the EPSS score is unavailable but indicates no known high exploitation probability. Because the attack relies on a forged HTTP request, any user who can load a malicious page on the same domain (or whose browser can be induced to send the request) can exploit it. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited, though the potential impact of granting administrator access remains significant.