Poweradmin CSV Injection Vulnerability (CVE-2024-47693) with POC and Attack Analysis

Vulnerability Overview Poweradmin v4.0.0 contains a CSV injection (formula injection) vulnerability in the log export endpoint. User-controlled data (specifically the username field) is not escaped when written to the exported CSV file, allowing formula trigger characters (such as , , , ) to be executed directly. When an administrator exports logs and opens the file in a spreadsheet application (such as Microsoft Excel, LibreOffice Calc, or Google Sheets), any formulas stored in the username are executed. This can be used to perform phishing attacks or exfiltrate data against administrators. Scope Affected Versions: - - CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: Required - Scope: Changed - Confidentiality: High - Integrity: Low - Availability: None CVE ID: CVE-2024-47693 Weakness: CWE-1236 Remediation Fixed Versions: - - Proof of Concept (POC) Impact This is a CSV injection vulnerability (CWE-1236). It affects any administrator who exports activity logs as a CSV file and opens the file in a spreadsheet application. Attack Scenarios Phishing: A malicious actor with the ability to create user accounts sets a formula-based username. In the exported report, this appears as a trusted link, enticing a higher-privileged administrator to click it. Data Exfiltration: By using formulas such as or similar techniques to access adjacent cell data (log contents), an attacker can silently exfiltrate data to a server under their control when the spreadsheet is opened.

Goal Reached Thanks to every supporter — we hit 100%!

Poweradmin CSV Injection Vulnerability (CVE-2024-47693) with POC and Attack Analysis

More from this source