Exploits / Vulnerability Discovered : 2023-05-31 |
Type : webapps |
Platform : php
This exploit / vulnerability Rukovoditel 3.3.1 csv injection is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
Exploit Title: Rukovoditel 3.3.1 - CSV injection
Version: 3.3.1
Bugs: CSV Injection
Technology: PHP
Vendor URL: https://www.rukovoditel.net/
Software Link: https://www.rukovoditel.net/download.php
Date of found: 27-05-2023
Author: Mirabbas Ağalarov
Tested on: Linux
2. Technical Details & POC
========================================
Step 1. login as user
step 2. Go to My Account ( http://127.0.0.1/index.php?module=users/account )
step 3. Set Firstname as =calc|a!z|
step 3. If admin Export costumers as CSV file ,in The computer of admin occurs csv injection and will open calculator (http://localhost/index.php?module=items/items&path=1)