CyberRota Analysis
AI-GeneratedPheditor versions 2.0.1 to before 2.0.6 contain a critical vulnerability due to a hardcoded default password, allowing unauthorized access to the file editor and its features. This flaw enables attackers to perform arbitrary file operations and execute remote code, posing significant risks to any deployment using the default credentials. Organizations utilizing Pheditor should prioritize immediate updates to version 2.0.6 or later to mitigate this severe security threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal features, enabling arbitrary file read/write and remote code execution. This issue has been patched in version 2.0.6.