CVE-2019-19208 Code injection in codiad

What is CVE-2019-19208?

CVE-2019-19208 is a critical code injection vulnerability in n/a, published on 16 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Codiad Web IDE through 2.8.4 allows PHP Code injection.

Weakness: CWE-94

Which versions are affected by CVE-2019-19208?

2 open source packages ship an affected version, including codiad/codiad. It affects 1 product.

Products include Codiad Codiad.

How do I fix CVE-2019-19208?

No fix has been published for CVE-2019-19208 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2019-19208 being exploited?

There is no known exploitation of CVE-2019-19208 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2018-14009 Codiad remote code execution vulnerability Critical 9.8
• CVE-2017-11366 Codiad Vulnerable to Shell Command Injection Critical 9.8
• CVE-2020-14043 Codiad CSRF Vulnerability High 8.8
• CVE-2020-23355 Codiad Vulnerable to PHP Magic Hash Vulnerability High 7.5
• CVE-2017-1000125 File upload in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v92m-hhhw-vv9v.