Anviz AIM CrossChex Standard 4.3 – CSV Injection
# Exploit Title: Anviz AIM CrossChex Standard 4.3 - CSV Injection # Author: Gjoko 'LiquidWorm' Krstic @zeroscience # Date: 2018-11-01 # Vendor: Anviz Biometric Technology Co., Ltd. # Product web page: https://www.anviz.com # Affected version: 4.3.6.0 # Tested on: Microsoft Windows 7 Professional SP1 (EN) # CVE: N/A # References # Advisory ID: ZSL-2018-5498 # Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5498.php # Desc: CSV (XLS) Injection (Excel Macro Injection or Formula # Injection) exists in the AIM CrossChex 4.3 when importing # or exporting users using xls Excel file. This can be exploited # to execute arbitrary commands on the affected system via # SE attacks when an attacker inserts formula payload in the # 'Name' field when adding a user or using the custom fields # 'Gender', 'Position', 'Phone', 'Birthday', 'Employ Date' # and 'Address'. Upon importing, the application will launch # Excel program and execute the malicious macro formula. # PoC # From the menu: User -> Add -> use payload: =cmd|' /C mspaint'!L337 User -> Import / Export: use payload: =cmd|' /C mspaint'!L337 |