Lucene search
Francesco CarlucciWPEX-ID:E2A59481-DB45-4B8E-B17A-447303469364HistoryOct 17, 2022 - 12:00 a.m.
FluentForm < 4.3.13 - CSV Injection
2022-10-1700:00:00
Francesco Carlucci
73
fluentform
csv injection
unauthenticated
admin
export
spreadsheet application
exploit
vulnerability
EPSS
0.003
Percentile
68.8%
The plugin does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection
- As unauthenticated, submit a form using =5+5 as value in any field
- As admin, export the data as CSV (/wp-admin/admin.php?page=fluent_forms&form_id=1&route=entries)
- open the CSV with a spreadsheet application (Excel, Libre Office)
- the CSV formula gets executed Related
cvelist
cvelist
CVE-2022-3463 FluentForm < 4.3.13 - CSV Injection
2022-11-07 00:00:00
nvd
nvd
CVE-2022-3463
2022-11-07 10:15:11
openvas
openvas
WordPress Contact Form Plugin < 4.3.13 CSV Injection Vulnerability
2024-01-02 00:00:00
wpvulndb
wpvulndb
FluentForm < 4.3.13 - CSV Injection
2022-10-17 00:00:00
prion
prion
Design/Logic Flaw
2022-11-07 10:15:00
cve
cve
CVE-2022-3463
2022-11-07 10:15:11
patchstack
patchstack
WordPress FluentForm plugin <= 4.3.12 - CSV Injection vulnerability
2022-10-17 00:00:00