CVE-2022-31854

HIGHNuclei

CodoForum v5.1 - Remote Code Execution (RCE)

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-31854 has a selected CVSS score of 7.2 (high); EIP currently links 1 catalogued exploit, 1 repository PoC, and 1 Nuclei template.

Description

Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1
Nuclei templates
1

Proofs of concept

2

Catalogued exploits

ExploitDBCodoForum v5.1 - Remote Code Execution (RCE)ExploitDB exploitby Krish PandeyNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubVikaran101/CVE-2022-31854Repository PoCby Vikaran1015Not analyzed2 files

8.1 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHCodoforum 5.1 - Arbitrary File UploadCVSS 7.2

Codoforum 5.1 contains an arbitrary file upload vulnerability via the logo change option in the admin panel. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code. As a result, an attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

Successful exploitation of this vulnerability can result in unauthorized remote code execution on the affected system.

Remediation

Apply the latest security patch or upgrade to a patched version of Codoforum.

WeaknessesCWE-434
Authorstheamanrawat
Template tagscvecve2022rcecodoforumrceauthenticatedintrusivecodologicvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:codologic:codoforum:5.1:*:*:*:*:*:*:*
https://bitbucket.org/evnix/codoforum_downloads/downloads/codoforum.v.5.1.zip https://codoforum.com/ https://vikaran101.medium.com/codoforum-v5-1-authenticated-rce-my-first-cve-f49e19b8bc https://nvd.nist.gov/vuln/detail/CVE-2022-31854 https://github.com/trhacknon/Pocingit

Source: ProjectDiscovery

References

5