# Codo Writeup - Proving Grounds

> Easy Linux box running CodoForum v5.1 with default admin credentials, exploited via the CVE-2022-31854 authenticated file-upload RCE for a www-data shell, then escalated to root by reusing database credentials found in the web config.

- **URL:** https://hackindex.io/writeups/codo
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** file-upload, rce, default-credentials, credential-reuse, codoforum, cve-2022-31854
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

Codo runs CodoForum v5.1 with the default admin credentials. That build is vulnerable to CVE-2022-31854, an authenticated file-upload that bypasses extension checks and executes PHP in the attachments directory, giving a shell as `www-data`. The web config leaks database credentials that are reused for the root account.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7
# 80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
```

Only SSH and HTTP are open, so the web app on port 80 is the target. Fuzz it for directories.

### Directory discovery

Brute force directories.

```bash
dirsearch -u http://$TARGET_IP/
# [200]  /admin/                                   # CodoForum admin login
# [301]  /cache/
# [301]  /sites/default/assets/img/attachments/     # upload destination
```

The `/admin/` path is a CodoForum admin login and `/sites/default/assets/img/attachments/` is the upload destination.

## Enumeration

Port 80 runs **CodoForum v5.1**, a PHP forum CMS. The admin panel at `/admin/` accepts the default credentials `admin:admin`. CodoForum v5.1 is vulnerable to CVE-2022-31854, an authenticated arbitrary file upload that bypasses extension restrictions and runs PHP from the attachments directory.

## Exploitation

### CodoForum file-upload RCE (CVE-2022-31854)

From the admin panel, upload a PHP reverse shell through the forum's file attachment feature. It lands in the attachments directory, which executes PHP. Start a listener first.

```bash
nc -lvnp $ATTACKER_PORT
```

Browse to the uploaded payload at `http://$TARGET_IP/sites/default/assets/img/attachments/payload.php` to trigger it. The listener catches a shell as `www-data`.

## Privilege Escalation

### Database credential reuse

Enumerate the CodoForum configuration files, which hold database credentials `codo:$CODO_PASSWORD`. Try that password against the root account.

```bash
su -
# Password:
# root@codo:~# id
# uid=0(root) gid=0(root) groups=0(root)
```

The database password is reused for `root`, giving a root shell.

Related

## References

- [CVE-2022-31854](https://nvd.nist.gov/vuln/detail/CVE-2022-31854) - CodoForum v5.1 authenticated arbitrary file upload leading to remote code execution.
- [Exploit-DB 50978](https://www.exploit-db.com/exploits/50978) - CodoForum v5.1 arbitrary file upload exploit.