Lucene search
Lujiefsi36149A42-CBD5-445E-A371-E351C899B189HistoryJun 30, 2023 - 5:41 a.m.
CSV Injection while export users
2023-06-3005:41:41
lujiefsi
www.huntr.dev
7
csv injection
user management
admin actions
security risk
bug bounty
0.001 Low
EPSS
Percentile
39.3%
1 admin add a user, or a user signup.
2 the user logins and edit himeself
3 the user change his realname as “=1+cmd|‘/C calc’!A0”
4 admin go to export the users as a csv file
5 admin open the csv and we can see that the calculator is opened.
see https://owasp.org/www-community/attacks/CSV_Injection to fix it.
Related
cve
cve
CVE-2023-4006
2023-07-31 01:15:09
prion
prion
Input validation
2023-07-31 01:15:00
osv
osv
CVE-2023-4006
2023-07-31 01:15:09
github
github
cvelist
cvelist
veracode
veracode
CSV Injection
2023-08-02 05:53:47
nvd
nvd
CVE-2023-4006
2023-07-31 01:15:09
openvas
openvas
phpMyFAQ < 3.1.16 Multiple Vulnerabilities
2023-07-31 00:00:00