CVE-2021-24145

🗓️ 18 Mar 2021 14:57:50Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 226 Views🌐 WEB

Arbitrary file upload in Modern Events Calendar Lite WordPress plugi

Reporter	Title	Published	Views	Family All 19
0day.today	Wordpress Modern Events Calendar 5.16.2 Plugin - Remote Code Execution (Authenticated) Exploit	2 Jul 202100:00	–	zdt
0day.today	WordPress Modern Events Calendar Remote Code Execution Exploit	26 Jul 202100:00	–	zdt
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Webnus Modern_Events_Calendar_Lite	14 Aug 202102:56	–	githubexploit
Circl	CVE-2021-24145	10 Jul 202116:29	–	circl
CNNVD	Wordpress Modern Events Calendar Lite 代码问题漏洞	18 Mar 202100:00	–	cnnvd
Check Point Advisories	WordPress Modern Events Calendar Plugin Remote Code Execution (CVE-2021-24145)	18 Aug 202100:00	–	checkpoint_advisories
Cvelist	CVE-2021-24145 Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE	18 Mar 202114:57	–	cvelist
Exploit DB	Wordpress Plugin Modern Events Calendar 5.16.2 - Remote Code Execution (Authenticated)	2 Jul 202100:00	–	exploitdb
Metasploit	Wordpress Plugin Modern Events Calendar - Authenticated Remote Code Execution	26 Jul 202117:43	–	metasploit
Nuclei	WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload	7 Jun 202603:02	–	nuclei

NVD

Vulners

Node

webnus modern_events_calendar_liteRange<5.16.5wordpress

[
  {
    "product": "Modern Events Calendar Lite",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "5.16.5",
        "status": "affected",
        "version": "5.16.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/f42cc26b-9aab-4824-8168-b5b8571d1610
packetstormsecurity	www.packetstormsecurity.com/files/163346/WordPress-Modern-Events-Calendar-5.16.2-Shell-Upload.html
packetstormsecurity	www.packetstormsecurity.com/files/163672/WordPress-Modern-Events-Calendar-Remote-Code-Execution.html

Parameter	Position	Path	Description	CWE
feed	request body	wp-admin/admin.php?page=MEC-ix&tab=MEC-import	Authenticated arbitrary file upload via MEC import endpoint (CVE-2021-24145) enabling PHP payload upload due to improper file checks (CSV content-type used to bypass).	CWE-434
mec-ix-action	request body	wp-admin/admin.php?page=MEC-ix&tab=MEC-import	Authenticated arbitrary file upload via MEC import endpoint (CVE-2021-24145) enabling PHP payload upload due to improper file checks (CSV content-type used to bypass).	CWE-434

21 Nov 2024 05:52Current

7High risk

Vulners AI Score7

CVSS 26.5

CVSS 3.17.2

EPSS0.91299

CWE-434