Serv-U FTP Server 15.1.7 CSV Injection

`Issue: CSV injection vulnerability  
  
CVE: CVE-2019-13181  
  
Security researcher: Richard Tan @ The Missing Link Security  
  
Product name: Serv-U FTP Server  
  
Product version: Tested on 15.1.7  
  
Fixed in: Serv-U 15.1.7 Hotfix 2  
  
  
  
  
  
# Overview  
  
The application allowed table entries to contain a string which could be  
evaluated by Excel as a Dynamic Data Exchange (DDE) macro.  
  
Privileged users who has the appropriate rights to modify or create users  
could insert values into user properties which is evaluated as macros if the  
user list is exported as an Excel format.  
  
  
  
Steps to reproduce (Proof of concept):  
  
1) Login as a user that has privileges to create or modify users.  
  
2) Create a new user and add the following payload into the  
"description" field. "=cmd|'/C calc.exe'!A0"  
  
3) Export the user list with a file name "CSVinjection.csv" on the  
application server.  
  
4) On the application server, locate the file and execute it. Notice  
that a warning sign could be prompted depending the Excel's security  
settings. (If so click enable)  
  
5) Observe that the calculator tool is executed. This is a proof of  
concept however an adversary could exploit this weakness to potentially gain  
access to the application server (or from where ever the file is executed  
from).  
  
  
  
`