CVE-2021-24145 Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE

🗓️ 18 Mar 2021 14:57:50Reported by WPScanType

Arbitrary file upload vulnerability in Modern Events Calendar Lite < 5.16.

Reporter	Title	Published	Views	Family All 19
0day.today	Wordpress Modern Events Calendar 5.16.2 Plugin - Remote Code Execution (Authenticated) Exploit	2 Jul 202100:00	–	zdt
0day.today	WordPress Modern Events Calendar Remote Code Execution Exploit	26 Jul 202100:00	–	zdt
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Webnus Modern_Events_Calendar_Lite	14 Aug 202102:56	–	githubexploit
Circl	CVE-2021-24145	10 Jul 202116:29	–	circl
CNNVD	Wordpress Modern Events Calendar Lite 代码问题漏洞	18 Mar 202100:00	–	cnnvd
Check Point Advisories	WordPress Modern Events Calendar Plugin Remote Code Execution (CVE-2021-24145)	18 Aug 202100:00	–	checkpoint_advisories
CVE	CVE-2021-24145	18 Mar 202114:57	–	cve
Exploit DB	Wordpress Plugin Modern Events Calendar 5.16.2 - Remote Code Execution (Authenticated)	2 Jul 202100:00	–	exploitdb
Metasploit	Wordpress Plugin Modern Events Calendar - Authenticated Remote Code Execution	26 Jul 202117:43	–	metasploit
Nuclei	WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload	16 Jun 202607:13	–	nuclei

[
  {
    "product": "Modern Events Calendar Lite",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "5.16.5",
        "status": "affected",
        "version": "5.16.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/f42cc26b-9aab-4824-8168-b5b8571d1610
packetstormsecurity	www.packetstormsecurity.com/files/163346/WordPress-Modern-Events-Calendar-5.16.2-Shell-Upload.html
packetstormsecurity	www.packetstormsecurity.com/files/163672/WordPress-Modern-Events-Calendar-Remote-Code-Execution.html

26 Jul 2021 17:06Current

7.2High risk

Vulners AI Score7.2

EPSS0.88158

CWE-434