PT-2025-51742 · Phpfm · Phpfm

Thoughtfault · Published 2025-12-16 · Updated 2026-01-21 · CVE-2023-53894

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpfm version 1.7.9

Description phpfm version 1.7.9 contains an authentication bypass. This occurs due to a loose type comparison during password hash validation. Attackers can bypass authentication by crafting specific password hashes starting with '0e' or '00e', allowing unauthorized access. Successful exploitation enables attackers to upload malicious PHP files to the server. The vulnerable component is the password hash validation process, specifically the comparison logic within the checkPassword() function. The vulnerable parameter is the password hash.

Recommendations Update to a newer version of phpfm that addresses this issue.

Exploit

Fix

Weakness Enumeration

CWE-1390

Related Identifiers

CVE-2023-53894

Affected Products

Phpfm

References · 10

• 🔥 https://exploit-db.com/exploits/51594 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53894 · Security Note
• https://osv.dev/vulnerability/CVE-2023-53894 · Vendor Advisory
• https://twitter.com/CVEnew/status/2000986382005915717 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001086218491011418 · Twitter Post
• https://dulldusk.com/phpfm · Note
• https://vulncheck.com/advisories/phpfm-authentication-bypass-via-type-juggling-vulnerability · Note
• https://twitter.com/CveFindCom/status/2000984194436968584 · Twitter Post
• https://twitter.com/0dayPublishing/status/2000976888164970957 · Twitter Post
• https://t.me/cveNotify/149481 · Telegram Post