Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password — pheditor / pheditor
Summary
The forced password-change flow, triggered when the stored password is still the default (admin), does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditor_password is enough to reach the password-change form, and submitting pheditor_new_password / pheditor_confirm_password in the same request is enough to set an arbitrary new password and obtain an authenticated session — without ever proving knowledge of the current password.
Root Cause
pheditor.php line 163:
if (PASSWORD == hash('sha512', 'admin')) { // still default — force change prompt
This checks whether the stored PASSWORD constant is still the default value. It does not check whether the submitted pheditor_password matches it. As a result, on any instance that hasn't changed the default password, the check passes regardless of what the client actually sends, and the subsequent password-change branch is reachable without authentication.
PoC
TARGET="https://victim.com/pheditor.php"
# Any non-empty value works here — password is never actually verified
curl -c /tmp/j.txt \
-d 'pheditor_password=anything' \
-d 'pheditor_new_password=attacker123' \
-d 'pheditor_confirm_password=attacker123' \
"$TARGET" -L -s -o /dev/null
# Session is now authenticated as admin, with the password changed to attacker123
Impact
On any instance where the default password has not yet been changed, an unauthenticated attacker can set an arbitrary new admin password and obtain a fully authenticated session, without knowing the current password. This is a complete authentication bypass, not merely "default credentials in use" — it holds even if the operator believes the instance is protected because the login form is present.
Remediation
Verify the submitted password against the stored PASSWORD constant before entering the forced password-change branch, so the flow is reachable only by someone who actually knows the current password:
$submitted_hash = hash('sha512', $_POST['pheditor_password']);
if (PASSWORD == hash('sha512', 'admin') && $submitted_hash === PASSWORD) {
// proceed to forced password-change flow
} else {
// treat as a normal login attempt (including rate-limiting)
}
Note on scope
The original report submitted alongside this finding also included two additional items:
- Unrestricted PHP upload — addressed as intended behavior (Pheditor is a single-admin PHP file editor; PHP file creation/editing is core to its function, and pattern-restricting only the upload path doesn't reduce risk since the same result is reachable via the
save/newfileaction). Documented explicitly in the README's new Security Model section. - Terminal allowlist bypass (
php -r ...) — a duplicate of a previously reported and already-patched issue (GHSA-g3hq-hphg-8fhh, fixed in v2.0.7).
This advisory has been scoped to the authentication bypass specifically, since it's a distinct root cause from both of those. Full responses to all three points are in the comments below.
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime
Frequently Asked Questions
A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.
CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.
A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.
Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.
Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.
SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.