SIM-PKH 2.4.1 contains an arbitrary file upload flaw that lets any authenticated user upload files by sending PHP code in the fupload field. The uploaded PHP files are stored in the foto directory and are later interpreted by the web server, enabling an attacker to execute arbitrary code on the host. The flaw is a classic file‑upload vulnerability, classified as CWE‑434, and can lead directly to remote code execution and full compromise of the affected system.

This issue affects the SIM-PKH application from Simpkh, specifically version 2.4.1. The vulnerability is triggered by accessing the aksi_pengurus.php endpoint with module=pengurus and act=update parameters while authenticated. No other versions or products were listed as impacted in the CNA data.

The CVSS base score of 8.7 indicates a high severity flaw. Because only authenticated users can trigger the upload, an attacker first needs valid credentials, which may be gained via phishing, credential reuse, or social engineering. Once authenticated, uploading a PHP file into the foto directory is trivial; the file is then executed by the web server. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that, while the flaw is serious, it has not yet been widely exploited. Nonetheless, the potential for full system compromise warrants immediate attention.