CVE-2017-11366

CRITICAL

Codiad < 2.8.4 - Remote Code Execution via File Manager Search Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2017-11366. PoCs published by lolameroo, hidog123.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2018-14009, targeting Codiad 2.8.4. The exploit leverages command injection via the file search functionality to achieve remote code execution (RCE) on both Windows and Linux systems.

Description

components/filemanager/class.filemanager.php in Codiad before 2.8.4 is vulnerable to remote command execution because shell commands can be embedded in parameter values, as demonstrated by search_file_type.

Exploits (2)

nomisec WORKING POC
by lolameroo · poc
https://github.com/lolameroo/Codiad-CVE-2018-14009

This repository contains a functional exploit for CVE-2018-14009, targeting Codiad 2.8.4. The exploit leverages command injection via the file search functionality to achieve remote code execution (RCE) on both Windows and Linux systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Codiad 2.8.4
Auth required
Prerequisites: Valid credentials for Codiad · Network access to the target · Writeable directories in Codiad
devstral-2 · analyzed Apr 27, 2026 Full analysis →
nomisec WORKING POC
by hidog123 · poc
https://github.com/hidog123/Codiad-CVE-2018-14009

This exploit targets CVE-2018-14009 in Codiad 2.8.4, leveraging a command injection vulnerability in the file search functionality to achieve remote code execution (RCE). It supports both Windows (PowerShell) and Linux (Bash) payloads for reverse shell establishment.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Codiad 2.8.4
Auth required
Prerequisites: Valid credentials for Codiad · Network access to the target · Writeable directories in Codiad
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Third Party Advisory x_refsource_misc
http://www.jianshu.com/p/41ac7ac2a7af
Third Party Advisory x_refsource_misc
https://github.com/Codiad/Codiad/issues/1011
Third Party Advisory x_refsource_misc
https://github.com/Codiad/Codiad/pull/1013

Scores

CVSS v3 9.8
EPSS 0.3435
EPSS Percentile 97.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (2)
codiad/codiad < 2.8.3
codiad/codiad 0 - 2.8.3Packagist
Published Aug 21, 2017
Tracked Since Feb 18, 2026