Exploit RosarioSIS 10.8.4 - CSV Injection

[Exploiter]

EDB-ID

51622

Проверка EDB

1. Пройдено

Автор

RANJEET JAISWAL

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2023-29918

Дата публикации

2023-07-28

RosarioSIS 10.8.4 - CSV Injection

# Exploit Title: RosarioSIS 10.8.4 - CSV Injection
# Google Dork:NA
# Exploit Author: Ranjeet Jaiswal#
# Vendor Homepage: https://www.rosariosis.org/
# Software Link: https://gitlab.com/francoisjacquet/rosariosis/-/archive/v10.8.4/rosariosis-v10.8.4.zip
# Affected Version: 10.8.4
# Category: WebApps
# Tested on: Windows 10
# 
#
# 1. Vendor Description:
#
# RosarioSIS has been designed to address the most important needs of administrators, teachers, support staff, parents, students, and clerical   personnel. However, it also adds many components not typically found in Student Information Systems. 
#
# 2. Technical Description:
#
# A CSV Injection (also known as Formula Injection) vulnerability in the RosarioSIS web application with version 10.8.4 allows malicious users to execute malicious payload in csv/xls and redirect authorized user to malicious website.

#
# 3. Proof Of Concept:

 3.1. Proof of Concept for CSV injection.

# #Step to reproduce.
Step1:Login in to RosarioSIS 10.8.4
Step2:Go to Periods page
Step3:Add CSV injection redirection payload such as "=HYPERLINK("https://www.google.com","imp")"in the Title field
Step4:click on Save button to save data.
Step5:Go to export tab and export the data
Step6:When user open download Periods.xls file.You will see redirection hyperlink.
Step7:When user click on link ,User will be redirected to Attacker or
malicious website.



# 4. Solution:
 Upgrade to latest release of RosarioSIS.