4
[webapps] projectSend r1605 - CSV injection
source link: https://www.exploit-db.com/exploits/51517
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
projectSend r1605 - CSV injection
EDB-ID:
51517
EDB Verified:
Exploit Title: projectSend r1605 - CSV injection
Version: r1605
Bugs: CSV Injection
Technology: PHP
Vendor URL: https://www.projectsend.org/
Software Link: https://www.projectsend.org/
Date of found: 11-06-2023
Author: Mirabbas Ağalarov
Tested on: Windows
2. Technical Details & POC
========================================
Step 1. login as user
step 2. Go to My Account ( http://localhost/users-edit.php?id=2 )
step 3. Set name as =calc|a!z|
step 3. If admin Export action-log as CSV file ,in The computer of admin occurs csv injection and will open calculator ( http://localhost/actions-log.php )
payload: =calc|a!z|
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK