ID:8335 - Exploit for Arbitrary file upload in Modern Events Calendar Lite - CVE-2021-24145

Link to public exploit:

Vulnerability description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to insufficient validation of content-type when processing files uploads. A remote website administrator can upload an arbitrary PHP file by setting its content-type to "text/csv" and execute it on the server.

Remediation