CVE-1236: CSV Formula Injection in myComments.download.php, POC & Fix

Vulnerability Overview Title: CSV Formula Injection: User-controllable comment text written to CSV export in without sanitization Type: CSV Formula Injection (CSV Injection / Formula Injection) Severity: Medium (CVSS v3.1 Base Score: 5.4/10) CVE: CVE-1236 Description: uses to write comment text, author, and video title into the CSV, without escaping characters such as , , , and . If a user comment starts with , applications like Excel will execute it as a formula. Impact: Any user who opens the exported CSV will have the embedded formula executed by their local Excel/Office application (classic CSV Formula Injection). The source site is no longer required after the file has been downloaded. Scope of Impact Affected Versions: Fixed Version: (The vulnerability was not fixed at the time of reporting; this commit is the fix commit) Similar Risks: Similar CSV export endpoints exist in , , and . Low-privilege accounts can poison the data, and it becomes visible to administrators when . Remediation Fix Commit: Fix Method: Prefix cells starting with , , , or with a single quote (or strip the prefix) before writing to the CSV. This involves escaping/filtering the text before passing it to . POC / Exploit Code Preconditions: The Lab Host must be , and the cookie must use the password hash stored via . Step 1: Plant the Comment (POST) Step 2: Export CSV (GET) Verification: The comment column in the CSV contains ; opening it in Excel/Office will execute it as a formula. Control: The comment is a normal cell and will not trigger formula execution.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-1236: CSV Formula Injection in myComments.download.php, POC & Fix

More from this source