admidio v4.2.5 - CSV Injection

vendor:

admidio

by:

Mirabbas Agalarov

7.4

CVSS

HIGH

CSV Injection

CWE

Product Name: admidio

Affected Version From: 4.2.2005

Affected Version To: 4.2.2005

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows

2023

admidio v4.2.5 – CSV Injection

Admidio is vulnerable to CSV injection when a malicious user sets their postal code to a specially crafted payload. If an admin then exports users as a CSV or Excel file, the payload will be executed on the admin's computer, in this case opening the calculator.

Mitigation:

Input validation should be used to prevent malicious payloads from being injected into the system.

Source

Exploit-DB raw data:

Exploit Title: admidio v4.2.5 - CSV Injection
Application: admidio
Version: 4.2.5
Bugs:  CSV Injection
Technology: PHP
Vendor URL: https://www.admidio.org/
Software Link: https://www.admidio.org/download.php
Date of found: 26.04.2023
Author: Mirabbas Ağalarov
Tested on: Windows


2. Technical Details & POC
========================================
Step 1. login as user
step 2. Go to My profile (edit profile) and set postal code  as =calc|a!z| and save (http://localhost/admidio/adm_program/modules/profile/profile_new.php?user_uuid=4b060d07-4e63-429c-a6b7-fc55325e92a2)
step 3. If admin Export users as CSV or excell file ,in The computer of admin  occurs csv injection and will open calculator (http://localhost/admidio/adm_program/modules/groups-roles/lists_show.php?rol_ids=2)

payload: =calc|a!z|

Poc video:  https://www.youtube.com/watch?v=iygwj1izSMQ