Rukovoditel 3.3.1 – CSV injection

  • 作者: Mirabbas Ağalarov
    日期: 2023-05-31
  • 类别:
    平台:
  • 来源:https://www.exploit-db.com/exploits/51490/
  • Exploit Title: Rukovoditel 3.3.1 - CSV injection
    Version: 3.3.1
    Bugs:CSV Injection
    Technology: PHP
    Vendor URL: https://www.rukovoditel.net/
    Software Link: https://www.rukovoditel.net/download.php
    Date of found: 27-05-2023
    Author: Mirabbas Ağalarov
    Tested on: Linux 
    
    
    2. Technical Details & POC
    ========================================
    Step 1. login as user
    step 2. Go to My Account ( http://127.0.0.1/index.php?module=users/account )
    step 3. Set Firstname as=calc|a!z|
    step 3. If admin Export costumers as CSVfile ,in The computer of adminoccurs csv injection and will open calculator (http://localhost/index.php?module=items/items&path=1)
    
    payload: =calc|a!z|