CVE-2020-13873

Name of the Vulnerable Software and Affected Versions Codoforum versions prior to 4.9

Description The issue concerns a SQL Injection vulnerability in the get topic info() function. This vulnerability allows remote attackers to bypass the admin page via a leaked password-reset token of the admin, potentially leading to the upload of a PHP shell and execution of remote code on the operating system. The vulnerability is related to the lack of protection against SQL query structure exploitation, which can enable a remote attacker to execute arbitrary code on the target system.

Recommendations For Codoforum versions prior to 4.9, update to version 4.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the get topic info() function in sys/CODOF/Forum/Topic.php to minimize the risk of exploitation.