CVE-2020-37091: Maian Support Helpdesk CSRF Vulnerability

CVE-2020-37091 Overview

CVE-2020-37091 is a cross-site request forgery (CSRF) vulnerability in Maian Support Helpdesk version 4.3. The application fails to validate the origin of state-changing requests in its administrative interface. Attackers can craft malicious HTML forms that, when submitted by an authenticated administrator, create new administrative accounts without further authorization. The vulnerability also enables abuse of the FAQ attachment system to upload PHP files due to unrestricted file upload handling. The flaw is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows unauthenticated attackers to gain administrative access and upload arbitrary PHP files, leading to full compromise of the helpdesk application.

Affected Products

Maian Support Helpdesk 4.3
Installations exposing the administrative panel to authenticated administrators who may visit untrusted sites
Deployments using the default FAQ attachment configuration

Discovery Timeline

2026-02-03 - CVE-2020-37091 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2020-37091

Vulnerability Analysis

The vulnerability stems from missing anti-CSRF tokens on administrative endpoints in Maian Support Helpdesk 4.3. State-changing actions, including the creation of administrative users, accept requests based only on session cookies. An attacker who lures an authenticated administrator to a malicious page can trigger account creation requests using the administrator's session context.

A second issue compounds the impact. The FAQ attachment functionality does not restrict file types on upload. When combined with the CSRF flaw, an attacker can submit a forged request that uploads a PHP file to a web-accessible directory. Executing that file yields code execution within the web server context.

Root Cause

The root cause is the absence of CSRF protections such as synchronizer tokens, SameSite cookie attributes, or origin/referer validation on administrative request handlers. The application trusts any request bearing a valid session cookie regardless of where it originated. The unrestricted file upload behavior in the FAQ attachment handler amplifies the impact from privilege escalation to arbitrary code execution.

Attack Vector

Exploitation requires an authenticated administrator to load an attacker-controlled page while their helpdesk session is active. The malicious page hosts an auto-submitting HTML form targeting the administrative user-creation endpoint with attacker-chosen credentials. A follow-up forged request uploads a PHP payload through the FAQ attachment endpoint. The attacker then logs in with the newly created admin account or invokes the uploaded PHP file directly. Public proof-of-concept material is referenced in Exploit-DB #48386 and the VulnCheck Security Advisory.

No verified code examples are available. Refer to the linked advisory for technical proof-of-concept details.

Detection Methods for CVE-2020-37091

Indicators of Compromise

Unexpected administrator accounts in the Maian Support Helpdesk user database, particularly those created outside normal change windows.
PHP files present in FAQ attachment directories where only document or image files should exist.
Web server access logs showing POST requests to admin user-creation endpoints with Referer headers pointing to external domains.

Detection Strategies

Inspect HTTP request logs for administrative POST requests lacking a same-origin Referer or Origin header.
Hash and inventory all files under the FAQ attachment directory and alert on .php, .phtml, or .phar extensions.
Correlate new administrator account creation events with the originating IP address and user-agent of the active admin session.

Monitoring Recommendations

Enable verbose audit logging for all administrative actions, including account creation and file uploads.
Forward web server and application logs to a centralized analytics platform for retention and query.
Schedule recurring integrity scans of web-accessible directories to detect unauthorized file additions.

How to Mitigate CVE-2020-37091

Immediate Actions Required

Restrict access to the Maian Support Helpdesk administrative panel by IP allow-listing or VPN.
Audit existing administrator accounts and remove any that cannot be attributed to a known operator.
Inspect FAQ attachment directories and remove any executable files such as .php, .phtml, or .phar.
Require administrators to use a dedicated browser profile that is not used for general browsing.

Patch Information

No vendor patch is referenced in the available advisory data. Operators should contact the vendor at maiansupport.com for an updated release or consider migrating away from Maian Support Helpdesk 4.3 if no fix is published. Review the VulnCheck Security Advisory for the latest remediation guidance.

Workarounds

Place the administrative endpoint behind a reverse proxy that enforces Origin and Referer header validation.
Configure session cookies with the SameSite=Strict attribute to block cross-site request inclusion.
Deny execution of PHP files inside upload directories through web server configuration.

bash

# Apache: deny PHP execution within the FAQ attachment directory
<Directory "/var/www/maian/uploads/faq">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ^~ /uploads/faq/ {
    location ~ \.(php|phtml|phar)$ { deny all; }
}