CVE-2018-14009

Vulnerability

Codiad versions through 2.8.4 contain a remote code execution vulnerability [CVE-2018-14009] that is distinct from CVE-2017-11366 and CVE-2017-15689 [1], [2], [3]. The bug resides in the user-controllable endpoints that do not properly validate or sanitize input, allowing an attacker to inject arbitrary PHP code into the server's file system. The code path is reachable without authentication, and the vulnerability affects all installations running Codiad 2.8.4 and earlier [1], [3].

Exploitation

An attacker with network access to the Codiad instance can send crafted HTTP requests to the application's management interfaces, leveraging insufficient input validation to write arbitrary PHP code to a file within the web root [1], [3]. The exploit sequence typically involves authenticating with a known username/password (default credentials admin:admin), then abusing the project management or file system endpoints to upload or modify a .php file containing attacker-controlled code [1], [3]. The exploit is publicly available as a Python script (e.g., the one by WangYihang) that automates the entire process, requiring only the target URL and credentials [3].

Impact

Successful exploitation gives the attacker the ability to execute arbitrary operating system commands with the privileges of the web server user [1], [3]. This results in complete compromise of the Codiad application and potentially the underlying server, allowing data exfiltration, lateral movement, or further exploitation of the host environment. The vulnerability is classified as remote code execution (RCE) with a high severity impact [2].

Mitigation

As of the most recent references (2025), Codiad is no longer under active maintenance, and no official patch has been released for this vulnerability [4]. Users are strongly advised to migrate to alternative, actively maintained web-based IDE solutions [4]. If immediate migration is not possible, access to the Codiad instance should be restricted to trusted networks, default credentials must be changed, and the application should be monitored for suspicious activity [1], [3]. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.