WP-CRM <= 1.2.1 - CSV Injection

2022-05-1800:00:00

Ankur Bakre

wp-crm

csv injection

calculator payload

export csv

vulnerable application

EPSS

0.001

Percentile

34.8%

JSON

The plugin does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.

1. Add new person and put the following CSV calculator payload into the Display Name, Phone Number and Description field and save the entry.
payload : =cmd|' /C calc'!'A1'  or  =cmd|' /C calc'!A0

2. In the All People section, click on "Export CSV"

If the csv is opened in a vulnerable application, the payload will execute.

EPSS

0.001

Percentile

34.8%

JSON

Related for WPEX-ID:53C8190C-BAEF-4807-970B-F01AB440576A