CVE-2020-25398 PoC — Mind iMind Server 安全漏洞

Source

https://github.com/h3llraiser/CVE-2020-25398

Associated Vulnerability

Title:Mind iMind Server 安全漏洞 (CVE-2020-25398)
Description:Mind iMind Server是俄罗斯mind的一个视频会议平台。 Mind iMind Server 3.13.65及之前版本存在注入漏洞，该漏洞可使攻击者通过csv导出功能进行csv注入操作，进而危害系统。

Description

CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality.

Readme

# CVE-2020-25398
CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality.
# Information

Description: Attacker can configure specific data, which could be exported to malicious csv file with code execution payload and runs after opening on user's machine.

Researcher: Andrey Skuratov (https://github.com/h3llraiser/)

Issue date: 2020-07-06 (Initial Advisory)

Public release:

VEL Link: Info will be soon

NIST CVE Link: Info will be soon


# Screenshots:

![](POC_1_1.png)
![](POC_1_2.png)
![](POC_1_3.png)

File Snapshot


 [4.0K]  /data/pocs/b904a0a5deb2d74e937500fef064aeb42934bb4e
├── [ 29K]  POC_1_1.png
├── [ 68K]  POC_1_2.png
├── [ 91K]  POC_1_3.png
└── [ 550]  README.md

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!