CVE-2023-53894

The vulnerability results from the use of loose comparison operator (==) instead of strict (===) when verifying password hashes in PHP. PHP treats character strings starting with '0e' or '00e' as scientific notation for a floating-point number equal to zero, causing a crafted password hash to be considered equal to another hash with the same property. An attacker can construct an appropriate password string whose hash starts with '0e' or '00e', and the application will incorrectly confirm its correctness. After gaining access, the attacker can upload malicious PHP files to the server.

An unauthenticated remote attacker can bypass the authentication mechanism, take control of the application, and upload malicious PHP files, which consequently enables remote code execution (RCE) on the server.

Apply patches available from the vendor according to the references. As immediate remedial actions, it is recommended to restrict access to the phpFileManager interface at the firewall or web server level (e.g., restrict access only to trusted IP addresses) and enforce strong, unique passwords whose hashes do not start with '0e'/'00e'.

Dulldusk phpFileManager version 1.7.9