Description

The admidio application is vulnerable to Formula Injection/CSV injection via the Firstname, Lastname input fields. These vulnerabilities allow unauthenticated attackers to execute arbitrary code via a a crafted excel file.

Proof of Concept

1. Create a member with role Association’s board where they have permission to to edit profile of all members.
2. Edit the first name, last name with command =10+20+cmd|' /C calc'!A0.
3. Then from Association’s board/ admin accounts go to Groups and roles then show member list and export data in CSV format.
4. Open the downloaded CSV and the calc will pop up.

#PoC

https://drive.google.com/file/d/1YxPNFvzRPD9t3HRDN1jroBw7mxHwp4n3/view?usp=drive_link
https://drive.google.com/file/d/1cBV8TB2eE3NRbG1V_0eF3yL0oHOrez17/view?usp=drive_link