RosarioSIS 10.8.4 – CSV Injection - 体验盒子

作者： Ranjeet Jaiswal

日期： 2023-07-28

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/51622/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

# Exploit Title: RosarioSIS 10.8.4 - CSV Injection

# Google Dork:NA

# Exploit Author: Ranjeet Jaiswal#

# Vendor Homepage: https://www.rosariosis.org/

# Software Link: https://gitlab.com/francoisjacquet/rosariosis/-/archive/v10.8.4/rosariosis-v10.8.4.zip

# Affected Version: 10.8.4

# Category: WebApps

# Tested on: Windows 10

#

# 1. Vendor Description:

#

# RosarioSIS has been designed to address the most important needs of administrators, teachers, support staff, parents, students, and clerical personnel. However, it also adds many components not typically found in Student Information Systems.

#

# 2. Technical Description:

#

# A CSV Injection (also known as Formula Injection) vulnerability in the RosarioSIS web application with version 10.8.4 allows malicious users to execute malicious payload in csv/xls and redirect authorized user to malicious website.

#

# 3. Proof Of Concept:

3.1. Proof of Concept for CSV injection.

# #Step to reproduce.

Step1:Login in to RosarioSIS 10.8.4

Step2:Go to Periods page

Step3:Add CSV injection redirection payload such as "=HYPERLINK("https://www.google.com","imp")"in the Title field

Step4:click on Save button to save data.

Step5:Go to export tab and export the data

Step6:When user open download Periods.xls file.You will see redirection hyperlink.

Step7:When user click on link ,User will be redirected to Attacker or

malicious website.

# 4. Solution:

Upgrade to latest release of RosarioSIS.