Skip to content
OpenAdvisories
Unscored Public exploit CVE-2021-24307 EUVD-2021-11221GHSA-fg47-8fhh-p6fc

All in One SEO Pack < 4.1.0.2 - Admin RCE via unserialize

Published May 24, 2021 · Updated Aug 3, 2024 · Assigned by WPScan

Vendor: All in One SEO Team Product: All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings Category: Web / CMS

Description

The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section "Tool > Import/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.

Affected products

VendorProductAffectedFixed
All in One SEO Team All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings 4.1.0.2 – < 4.1.0.2 4.1.0.2

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References