CVE-2021-24145

Related Files

WordPress Modern Events Calendar Remote Code Execution

Posted Jul 26, 2021

Authored by Ron Jost, Yann Castel, Nguyen Van Khanh | Site metasploit.com

This Metasploit module allows an attacker with a privileged WordPress account to launch a reverse shell due to an arbitrary file upload vulnerability in WordPress Modern Events Calendar plugin versions prior to 5.16.5. This is due to an incorrect check of the uploaded file extension. Indeed, by using text/csv content-type in a request, it is possible to upload a .php payload as is is not forbidden by the plugin. Finally, the uploaded payload can be triggered by a call to /wp-content/uploads/<random_payload_name>.php.

tags | exploit, arbitrary, shell, php, file upload

advisories | CVE-2021-24145

SHA-256 | 69c7df31917c6908273c697f81d8629ab2b33991a9590623c7646f14dbb26004

Download | Favorite | View

WordPress Modern Events Calendar 5.16.2 Shell Upload

Posted Jul 2, 2021

Authored by Ron Jost

WordPress Modern Events Calendar plugin version 5.16.2 suffers from a remote shell upload vulnerability.

tags | exploit, remote, shell

advisories | CVE-2021-24145

SHA-256 | 8529bd568d3e33d5c15c9ae8583e97c47316e521e0b87a6184feab45a7cddfd7

Download | Favorite | View