header-logo
Suggest Exploit
vendor:
phpMyFAQ
by:
Mirabbas Agalarov
7.4
CVSS
HIGH
CSV Injection
897
CWE
Product Name: phpMyFAQ
Affected Version From: 3.1.12
Affected Version To: 3.1.12
Patch Exists:
Related CWE:
CPE: a:phpmyfaq:phpmyfaq:3.1.12
Metasploit:
Other Scripts:
Platforms Tested: Windows
2023

phpMyFAQ v3.1.12 – CSV Injection

A CSV injection vulnerability was discovered in phpMyFAQ v3.1.12. An attacker can exploit this vulnerability by logging in as a user and changing their name to 'calc|a!z|' and then having an admin export users as a CSV file. This will cause a CSV injection to occur on the admin's computer, which will open the calculator.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in CSV files.
Source

Exploit-DB raw data:

Exploit Title: phpMyFAQ v3.1.12 - CSV Injection
Application: phpMyFAQ
Version: 3.1.12
Bugs:  CSV Injection
Technology: PHP
Vendor URL: https://www.phpmyfaq.de/
Software Link: https://download.phpmyfaq.de/phpMyFAQ-3.1.12.zip
Date of found: 21.04.2023
Author: Mirabbas Ağalarov
Tested on: Windows


2. Technical Details & POC
========================================
Step 1. login as user
step 2. Go to user control panel and change name as =calc|a!z| and save
step 3. If admin Export users as CSV ,in The computer of admin  occurs csv injection and will open calculator

payload: calc|a!z|
Poc video:  https://youtu.be/lXwaexX-1uU

Navigation

Suggest Exploit

Services By CQR