CVE-2021-24946
CRITICAL EXPLOITED IN THE WILD NUCLEIWordPress Modern Events Calendar SQLi Scanner
Title source: metasploitExploitation Summary
CVE-2021-24946 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 2 public exploits from researchers including Ron Jost, h00die, Hacker5preme (Ron Jost), red0xff, including a Metasploit module auxiliary/scanner/http/wp_modern_events_calendar_sqli.
A Nuclei detection template is also available.
AI-analyzed exploit summary This script automates SQL injection exploitation in WordPress Plugin Modern Events Calendar Lite by generating a sqlmap command targeting the 'time' parameter in the 'mec_load_single_page' AJAX action. It requires user input to specify the target and sqlmap retrieval options.
Description
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
Exploits (2)
This script automates SQL injection exploitation in WordPress Plugin Modern Events Calendar Lite by generating a sqlmap command targeting the 'time' parameter in the 'mec_load_single_page' AJAX action. It requires user input to specify the target and sqlmap retrieval options.
This Metasploit module exploits an unauthenticated time-based SQL injection vulnerability in the WordPress Modern Events Calendar plugin (CVE-2021-24946). It enumerates user credentials from the wp_users table by injecting malicious payloads into the 'time' parameter.
Nuclei Templates (1)
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H