Published on May 5th, 2023 📆 | 7105 Views ⚑

phpMyFAQ 3.1.12 CSV Injection – Torchsec

Exploit Title: phpMyFAQ v3.1.12 - CSV Injection
Application: phpMyFAQ
Version: 3.1.12
Bugs:  CSV Injection
Technology: PHP
Vendor URL: https://www.phpmyfaq.de/
Software Link: https://download.phpmyfaq.de/phpMyFAQ-3.1.12.zip
Date of found: 21.04.2023
Author: Mirabbas Ağalarov
Tested on: Windows2. Technical Details & POC
========================================
Step 1. login as user
step 2. Go to user control panel and change name as =calc|a!z| and save
step 3. If admin Export users as CSV ,in The computer of admin  occurs csv injection and will open calculator
payload: calc|a!z|
Poc video:  https://youtu.be/lXwaexX-1uU

Source link

Tagged with: 3.1.12 • csv • injection • phpmyfaq • torchsec

Comments are closed.

🌟 Your Account

Username/Email Password
Remember Me
Register
🔔 Email Subscriptions

Get new posts by email
- Donate Via Wallets
  MetaMask
  
  Trust Wallet
  
  Binance Wallet
  
  WalletConnect
Popular
- Event Management 1.0 SQL Injection – Torchsec by Admin March 28, 2024 # Exploit Title: Event Management - SQL Injection# Application: Event… (11)
- Artica Proxy Unauthenticated PHP Deserialization… by Admin March 27, 2024 ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule… (8)
- Siklu MultiHaul TG Series Credential Disclosure… by Admin March 29, 2024 # Exploit Title: Siklu MultiHaul TG series - unauthenticated credential… (8)
- Google Sues App Developers Over Fake Crypto… by Admin April 8, 2024 Apr 08, 2024NewsroomInvestment Scam / Mobile Security Google has filed… (8)
Gloss
- EdithImpagGE on Red Hat Security Advisory 2024-1882-03 – Torchsec
- EdithImpagGE on Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Insecure Direct Object Reference – Torchsec
- RaphaelImpomWM on Gentoo Linux Security Advisory 202403-04 – Torchsec
- slot gacor on Microsoft Windows Defender / Backdoor_JS.Relvelshe.A Detection / Mitigation Bypass – Torchsec
- belated birthday wishes on Microsoft Windows Defender / Backdoor_JS.Relvelshe.A Detection / Mitigation Bypass – Torchsec
- RaphaelImpomWM on Red Hat Security Advisory 2024-0642-03 – Torchsec
- Marinaztq on Red Hat Security Advisory 2024-0485-03 – Torchsec
- Marinaztq on Mirth Connect 4.4.0 Remote Command Execution – Torchsec
- Marinaztq on Vinchin Backup And Recovery 7.2 syncNtpTime Command Injection – Torchsec
- Marinaztq on Perfecting the Defense-in-Depth Strategy with Automation
☕️Social Media

Torchsec

Tweets by Torch_sec
👥Members

Newest | Active | Popular
- Waylon Lawrenson
  
  registered 1 hour, 41 minutes ago
- Colette Willison
  
  registered 3 hours, 41 minutes ago
- Tanya Reinhardt
  
  registered 4 hours, 33 minutes ago
- Lina Cabrera
  
  registered 4 hours, 45 minutes ago
- Aurelia Lovett
  
  registered 7 hours, 42 minutes ago
🌍 Forum Groups

Newest | Active | Popular | Alphabetical
- Programming & coding
  
  active 1 hour, 40 minutes ago
- Hardware
  
  active 1 hour, 40 minutes ago
- Help Me !!
  
  active 1 hour, 40 minutes ago
- General Talk
  
  active 1 hour, 41 minutes ago
- Linux / Open Source
  
  active 1 hour, 41 minutes ago
linktr.ee/obewyn

We share and comment on interesting infosec related news, tools and more. Follow us on RSS ,Facebook or Twitter for the latest updates. Torchsec is designed to help Auditors, Pentesters & Security Experts to keep their ethical hacking oriented toolbox up-to-date .
This website is made for educational and ethical testing purposes only。It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this website.

phpMyFAQ 3.1.12 CSV Injection – Torchsec

🌟 Your Account

🔔 Email Subscriptions

Get new posts by email

Donate Via Wallets

Popular

Gloss

☕️Social Media

👥Members

🌍 Forum Groups