Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pheditor/pheditor | composer | >= 2.0.1, < 2.0.6 | 2.0.6 |
Miggo AIRoot Cause AnalysisThe vulnerability is a hardcoded default password 'admin' in pheditor/pheditor. The analysis started by identifying the patched version from the advisory, which is 2.0.6. By comparing the git tags for the last vulnerable version (2.0.5) and the patched version (2.0.6), I found the fixing commit a64eb935ce699e43f1ea60e46d47f33e2f87ffd6. The commit message, 'feat(auth): implement password change functionality and enhance command security', confirmed its relevance.
The commit modifies pheditor.php, which contains the entire application's logic in a single script without distinct functions for authentication. The patch introduces a mandatory password change mechanism if the default password hash for 'admin' is detected. Previously, the code directly compared the user's input hash with the hardcoded default password hash, granting access upon a match. Since the authentication logic is in the global scope of the script, the entire pheditor.php file is considered the vulnerable component. A profiler would show execution within this script's main body during a login attempt. Therefore, pheditor.php itself is identified as the 'vulnerable function' for the purpose of runtime analysis.
pheditor.phppheditor.php