Maian Support Helpdesk 4.3 - Cross-Site Request Forgery (Add Admin)

The primary impact of CVE-2020-37091 is the potential for unauthorized administrative account creation. An attacker could leverage this to gain full control over the Maian Support Helpdesk instance. Furthermore, the unrestricted file upload capability allows attackers to upload malicious PHP files, which could then be executed on the server, leading to remote code execution (RCE). This could result in data breaches, system compromise, and complete control of the affected system. The ability to upload and execute arbitrary code significantly expands the attack surface and increases the potential damage.

Organizations utilizing Maian Support Helpdesk version 4.3 are at risk. This includes businesses relying on the helpdesk software for customer support and internal communication. Shared hosting environments are particularly vulnerable, as attackers could potentially exploit the vulnerability on multiple instances hosted on the same server.

• php / web:

curl -I <helpdesk_url>/faq.php?attach=<malicious_php_file>

• php / web:

grep -r 'admin_user_create' /var/www/html/

• generic web: Monitor access logs for unusual POST requests to account creation endpoints. • generic web: Check for newly uploaded PHP files in the FAQ attachment directory.

1. 2026-02-03Disclosure

   disclosure

1. 予約済み2026-02-01
2. 公開日2026-02-03
3. 更新日2026-02-04
4. EPSS 更新日2026-03-23

The recommended mitigation for CVE-2020-37091 is to upgrade to a patched version of Maian Support Helpdesk. Since a fixed version is not specified in the provided data, consider implementing temporary workarounds. These may include implementing strict input validation on all user-supplied data, particularly during account creation and file uploads. Additionally, consider enabling CSRF protection mechanisms within the application if possible. Regularly review FAQ attachments for suspicious files. After attempting any workaround, verify the system's security by attempting to create an administrative account via a crafted HTML form and uploading a test PHP file.