CVE-2022-31854

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.17.2High EPSS percentile98th32% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources FixVendor fixNo build named by the sources

Published 2022-07-07Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check if you are running Codoforum v5.1 and whether admin accounts could be compromised or misused.
Restrict admin panel access to trusted staff only and enforce strong, unique passwords plus two-factor authentication if available.
Contact Codoforum (https://codoforum.com) to confirm whether a patched version beyond v5.1 is available and apply it.
Until patched, review recently uploaded logo files and server directories for unfamiliar script files (e.g. .php, .jsp).
Consider disabling or tightly monitoring the logo-change feature until a fix is confirmed installed.

Vendor advisory Some work to apply

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.

In plain language

Written by AI from the record

If you run a Codoforum discussion forum, a malicious or compromised admin account could upload a hacking script through the logo-upload feature and take over your site; it's a real risk but only if someone already has admin access.

Codoforum v5.1 allows an authenticated administrator to achieve remote code execution via improper file-type validation (CWE-434) in the admin-panel logo-upload feature, enabling upload of executable scripts to the server.

If you're affected

Full website takeover
Malware/webshell hosting
Forum data exposure
Reputational damage from defacement

What is it

Codoforum is forum software used to run online discussion communities. This bug is like giving the person who manages your site's logo the ability to secretly slip a hidden tool into your building through the same door used for uploading images — if that person's account is stolen or misused, they could use it to break deeper into the system.

Who is affected

This matters to you if you run a Codoforum v5.1 community forum on your website. The flaw can only be exploited by someone who already holds valid administrator login credentials for the forum — it is not something a random outside visitor can trigger without first gaining admin access.

How urgent is it

No confirmed real-world attacks have been reported yet, but public proof-of-concept exploit code already exists on GitHub and sustained press attention shows this bug has drawn attacker interest. Because an attacker could cause full server compromise if an admin account is ever stolen, you should fix this soon rather than treat it as a low priority — but there is no evidence of active mass exploitation to justify an emergency response.

What to do — in detail

Confirm your deployment is Codoforum v5.1 (the only version flagged). 2. Check the vendor site (https://codoforum.com) for a release that fixes the logo-upload file-type validation issue — no specific fixed version number has been published in available findings, so contact the vendor directly for guidance. 3. As a temporary mitigation while awaiting a patch: restrict admin panel access via IP allowlisting or VPN, enforce MFA on admin accounts, and add server-side file-type/extension validation (reject non-image MIME types) on the logo-upload endpoint, or disable the logo-change feature entirely. 4. Audit existing uploaded logo files/directories for unexpected executable file types (.php, .jsp, .asp, etc.). 5. Monitor admin account login activity and web server logs for anomalous POST requests to the logo-upload endpoint. 6. Since two public PoCs exist on GitHub, treat this as weaponizable and prioritize closing admin-credential exposure (phishing, credential reuse) as the primary attack path.

Technical context

CVSS 3.1 score 7.2 (High) — AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H — requires high-privilege (admin) authentication, no user interaction, network vector, full confidentiality/integrity/availability impact. Weakness: CWE-434 (Unrestricted Upload of File with Dangerous Type). Not present in CISA KEV; no confirmed exploitation in the wild. Exploit maturity: two public PoC exploits available on GitHub, indicating functional exploit code exists. EPSS predicted probability is in the high percentile range with a falling trend, consistent with elevated-but-not-confirmed exploitation interest. Press attention has been sustained, reflecting researcher/community interest rather than active campaign evidence.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS98th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

32% chance of exploitation activity in the next 30 days, which ranks it in the 98th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-06-22EPSS band changehigh → moderate
2026-03-06Public exploit / PoCsource: github-pocnuclei check added
2024-11-21Patch availablerecord updated
2022-07-07Publishedweakness classified, att&ck mapped

Affected products

codologiccommercialaka codoforum, com freichat
- codoforumOn-premWeb & CMS Plugins / forum-wiki

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Scored 7.2 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable