Phpfm
Monthly
Missing authentication in dulldusk/phpFM through version 1.8.0 exposes the complete file manager to unauthenticated remote attackers because the default configuration ships with an empty auth_pass value. The flawed check in index.php (line 637, 'if ($auth_pass == '' || $loggedon==$auth_pass)') short-circuits to true whenever the password is unset, granting anyone full read, write, delete, and upload access to the server filesystem. CVSS 9.8 (CWE-306); no public exploit identified at time of analysis, though the vulnerable logic is directly visible in the referenced public source and is trivially reproducible.
Remote code execution in dulldusk phpfm through 1.8.0 lets an unauthenticated attacker upload a malicious PHP file and run it directly on the server. The application ships insecure-by-default: its upload extension allowlist is empty ($upload_ext_filter = array()) and authentication is off (auth_pass is an empty string), so no credentials or configuration changes are needed to reach the vulnerable upload handler. No public exploit has been identified at time of analysis, but the trivial exploitation path and 9.8 CVSS make this a high-priority server-takeover issue for any exposed instance.
Missing authentication in dulldusk/phpFM through version 1.8.0 exposes the complete file manager to unauthenticated remote attackers because the default configuration ships with an empty auth_pass value. The flawed check in index.php (line 637, 'if ($auth_pass == '' || $loggedon==$auth_pass)') short-circuits to true whenever the password is unset, granting anyone full read, write, delete, and upload access to the server filesystem. CVSS 9.8 (CWE-306); no public exploit identified at time of analysis, though the vulnerable logic is directly visible in the referenced public source and is trivially reproducible.
Remote code execution in dulldusk phpfm through 1.8.0 lets an unauthenticated attacker upload a malicious PHP file and run it directly on the server. The application ships insecure-by-default: its upload extension allowlist is empty ($upload_ext_filter = array()) and authentication is off (auth_pass is an empty string), so no credentials or configuration changes are needed to reach the vulnerable upload handler. No public exploit has been identified at time of analysis, but the trivial exploitation path and 9.8 CVSS make this a high-priority server-takeover issue for any exposed instance.