Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

• < 2.0.8

## Summary The forced password-change flow, triggered when the stored password is still the default (`admin`), does not verify that the password submitted by the client actually matches the current password. Any non-empty value in `pheditor_password` is enough to reach the password-change form, and submitting `pheditor_new_password` / `pheditor_confirm_password` in the same request is enough to set an arbitrary new password and obtain an authenticated session — without ever proving knowledge of the current password. ## Root Cause `pheditor.php` line 163: ```php if (PASSWORD == hash('sha512', 'admin')) { // still default — force change prompt ``` This checks whether the **stored** `PASSWORD` constant is still the default value. It does not check whether the **submitted** `pheditor_password` matches it. As a result, on any instance that hasn't changed the default password, the check passes regardless of what the client actually sends, and the subsequent password-change branch is reachable without authentication. ## PoC ```bash TARGET="https://victim.com/pheditor.php" # Any non-empty value works here — password is never actually verified curl -c /tmp/j.txt \ -d 'pheditor_pas

GitHub Advisory Database

• ECOSYSTEM: introduced 0; fixed 2.0.8

## Summary The forced password-change flow, triggered when the stored password is still the default (`admin`), does not verify that the password submitted by the client actually matches the current password. Any non-empty value in `pheditor_password` is enough to reach the password-change form, and submitting `pheditor_new_password` / `pheditor_confirm_password` in the same request is enough to set an arbitrary new password and obtain an authenticated session — without ever proving knowledge of the current password. ## Root Cause `pheditor.php` line 163: ```php if (PASSWORD == hash('sha512', 'admin')) { // still default — force change prompt ``` This checks whether the **stored** `PASSWORD` constant is still the default value. It does not check whether the **submitted** `pheditor_password` matches it. As a result, on any instance that hasn't changed the default password, the check passes regardless of what the client actually sends, and the subsequent password-change branch is reachable without authentication. ## PoC ```bash TARGET="https://victim.com/pheditor.php" # Any non-empty value works here — password is never actually verified curl -c /tmp/j.txt \ -d 'pheditor_pas

GitHub Advisory Database via OSV