admidio v4.2.5 – CSV Injection

• Exploit Database
• 113 阅读

• 作者： Mirabbas Ağalarov
  日期： 2023-05-02
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51402/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

  Exploit Title: admidio v4.2.5 - CSV Injection Application: admidio Version: 4.2.5 Bugs:CSV Injection Technology: PHP Vendor URL: https://www.admidio.org/ Software Link: https://www.admidio.org/download.php Date of found: 26.04.2023 Author: Mirabbas Ağalarov Tested on: Windows     2. Technical Details & POC ======================================== Step 1. login as user step 2. Go to My profile (edit profile) and set postal codeas =calc|a!z| and save (http://localhost/admidio/adm_program/modules/profile/profile_new.php?user_uuid=4b060d07-4e63-429c-a6b7-fc55325e92a2) step 3. If admin Export users as CSV or excell file ,in The computer of adminoccurs csv injection and will open calculator (http://localhost/admidio/adm_program/modules/groups-roles/lists_show.php?rol_ids=2)   payload: =calc|a!z|   Poc video:https://www.youtube.com/watch?v=iygwj1izSMQ