Codiad Vulnerable to PHP Magic Hash Vulnerability

HIGH 7.5CVE-2020-23355 · GHSA-8fhh-hf9w-55p7 · Published 27/01/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
codiad/codiad Packagist	`≤ 2.8.4`	No fix yet
codiad codiad	`= 2.8.4`	No fix yet

Description

Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authentication bypass. If encrypted or hash value for the passwords form certain formats of magic hash, e.g, 0e123, another hash value 0e234[something] can successfully authenticate.

NVD description

** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authentication bypass. If encrypted or hash value for the passwords form certain formats of magic hash, e.g, 0e123, another hash value 0e234 something can successfully authenticate.

References

nvd.nist.gov/vuln/detail/CVE-2020-23355 · ADVISORY
Codiad/Codiad · WEB
Codiad/Codiad · PACKAGE
web.archive.org/web/20160722013412/https://www.whitehatsec.com/blog/magic-hashes · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free