CVE-2020-15255

CSV injection in Anuko Time Tracker

CVSS 8.7 HIGHEPSS 3.5%CWE-74

In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fixed in version 1.19.23.5325.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Affected products

anuko · timetracker

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/159996/Anuko-Time-Tracker-1.19.23.5325-CSV-Injection.htmlunverified cve_referencewww.exploit-db.com/exploits/49027unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/159996/Anuko-Time-Tracker-1.19.23.5325-CSV-Injection.html https://github.com/anuko/timetracker/commit/d9472904361495f318c9d0294ffd28acaaeae42f https://github.com/anuko/timetracker/security/advisories/GHSA-prjf-9mgh-8fpv https://www.exploit-db.com/exploits/49027