Unscored CVE-2018-15474 EUVD-2018-7352GHSA-pqfm-q79f-gfxc

CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier al…

Published Sep 7, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Description

CSV Injection (aka Excel Macro Injection or Formula Injection) in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to execute arbitrary code via a value that is mishandled in a CSV export. NOTE: the vendor has stated "this is not a security problem in DokuWiki.

References

https://github.com/splitbrain/dokuwiki/issues/2450
https://www.sec-consult.com/en/blog/advisories/dokuwiki-csv-formula-injection-vulnerability/
20180906 SEC Consult SA-20180906-0 :: CSV Formula Injection in DokuWiki mailing-list
https://www.patreon.com/posts/unfixed-security-21250652