CVE-2021-24252

 

Published at: - 06-05-2021 03:15

Last modified: - 25-10-2022 09:26

Total changes: - 3

Description

The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation checks are missing (but would require WP to be loaded)

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/Event%20Banner.md
• https://wpscan.com/vulnerability/91e81c6d-f24d-4f87-bc13-746715af8f7c

 

Keywords

NVD

 

CVE-2021-24252

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures