PhpGedView Installation Page Exposure Scanner

PhpGedView is a web-based genealogy application used by family historians, researchers, and hobbyists to manage and share GEDCOM data. It provides tools for importing family trees, managing multimedia, and collaborating online. Deployed on web servers, it allows users to publish genealogical records for public or private access. However, its reliance on web interfaces demands strict security controls to prevent data leaks.

The vulnerability involves an exposed installation page that remains accessible after initial setup. This occurs when administrators fail to delete or restrict the install.php script post-deployment. Attackers can exploit this by navigating to the installation URL, potentially reinitializing the software and overwriting existing configurations.

Technically, the install.php endpoint is the target. If not removed or protected, an attacker can access it to modify database connection settings, create new admin accounts, or inject malicious code. The page typically lacks authentication, making it a high-risk entry point for unauthorized changes.

Exploitation can lead to full compromise of the PhpGedView instance, including data theft, defacement, or use as a pivot for further attacks. Sensitive genealogical data may be exposed, and the server could be leveraged for malicious activities. Immediate remediation is critical to prevent severe security breaches.