vendor:
CodoForum
by:
Krish Pandey
7.2
CVSS
HIGH
Remote Code Execution (RCE)
78
CWE
Product Name: CodoForum
Affected Version From: CodoForum v5.1
Affected Version To: CodoForum v5.1
Patch Exists: YES
Related CWE: CVE-2022-31854
CPE: a:codoforum:codoforum:5.1
Tags: cve,cve2022,rce,codoforumrce,authenticated,intrusive
CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Nuclei Metadata: {'max-request': 4, 'verified': True, 'vendor': 'codologic', 'product': 'codoforum'}
Platforms Tested: Ubuntu 20.04
2022
CodoForum v5.1 – Remote Code Execution (RCE)
CodoForum v5.1 is vulnerable to a Remote Code Execution (RCE) vulnerability. An authenticated attacker can upload a malicious PHP file to the server and execute arbitrary code. This exploit was discovered and written by Krish Pandey (@vikaran101).
Mitigation:
Ensure that the application is up to date and all security patches are applied. Restrict access to the application to trusted users.