Prestashop 8.0.4 - CSV injection

vendor:

Prestashop

by:

Mirabbas Agalarov

5.5

CVSS

MEDIUM

CSV injection

CWE

Product Name: Prestashop

Affected Version From: 8.0.4

Affected Version To: 8.0.4

Patch Exists: NO

Related CWE:

CPE: a:prestashop:prestashop:8.0.4

Metasploit:

Other Scripts:

Platforms Tested: Windows

2023

Prestashop 8.0.4 – CSV injection

This exploit allows an attacker to inject malicious formulas into a CSV file, which can then be executed when opened by a user. In this case, the exploit is triggered when an admin exports customers as a CSV file and opens it on their computer. The payload used in this exploit is '=calc|a!z|@test.com', which opens the calculator on the admin's computer.

Mitigation:

To mitigate this vulnerability, the application should sanitize user input before generating CSV files. Additionally, users should exercise caution when opening CSV files from untrusted sources.

Source

Exploit-DB raw data:

Exploit Title: Prestashop 8.0.4 - CSV injection
Application: prestashop
Version: 8.0.4
Bugs:  CSV Injection
Technology: PHP
Vendor URL: https://prestashop.com/
Software Link: https://prestashop.com/prestashop-edition-basic/
Date of found: 14.05.2023
Author: Mirabbas Ağalarov
Tested on: Windows


2. Technical Details & POC
========================================
Step 1. login as user
step 2. Go to My Account then information ( http://localhost/index.php?controller=identity )
step 3. Set Email as  =calc|a!z|@test.com
step 3. If admin Export costumers as CSV  file ,in The computer of admin  occurs csv injection and will open calculator (http://localhost/admin07637b2omxxdbmhikgb/index.php/sell/customers/?_token=mtc1BTvq-Oab2lBdfCaxpOorYraGGVMiTFluJzOpkWI)

payload: =calc|a!z|@test.com