vendor:
CSV Import & Export
by:
Kağan Çapar
7.5
CVSS
HIGH
SQL Injection & Cross-Site Scripting
89, 79
CWE
Product Name: CSV Import & Export
Affected Version From: 1.1.0
Affected Version To: 1.1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:codecanyon:csv_import_export:1.1.0
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Kali Linux
2018
CSV Import & Export v1.1.0 – SQL Injection / Cross-Site Scripting
The 'offset' and 'db' parameters in the database table preview query has vulnerabilities. An attacker can exploit this vulnerability by sending a malicious payload to the 'offset' and 'db' parameters. The payload can be a UNION query or a Cross-Site Scripting payload.
Mitigation:
Input validation should be done on the 'offset' and 'db' parameters to prevent malicious payloads from being executed.
