.. / CVE-2021-24145

• File Upload
• Nuclei
• Web

Exploit for WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload (CVE-2021-24145)

Description:

WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-type in the request. This can possibly lead to remote code execution.

Nuclei Template

View the template here CVE-2021-24145.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-24145.yaml

References: