c18d9953a2
22 changes to exploits/shellcodes/ghdb Keeper Security desktop 16.10.2 & Browser Extension 16.5.4 - Password Dumping Active Super Shop CMS v2.5 - HTML Injection Vulnerabilities Availability Booking Calendar v1.0 - Multiple Cross-site scripting (XSS) Dooblou WiFi File Explorer 1.13.3 - Multiple Vulnerabilities Joomla HikaShop 4.7.4 - Reflected XSS Joomla VirtueMart Shopping Cart 4.0.12 - Reflected XSS mooDating 1.2 - Reflected Cross-site scripting (XSS) October CMS v3.4.4 - Stored Cross-Site Scripting (XSS) (Authenticated) PaulPrinting CMS - (Search Delivery) Cross Site Scripting Perch v3.2 - Persistent Cross Site Scripting (XSS) RosarioSIS 10.8.4 - CSV Injection WordPress Plugin AN_Gradebook 5.0.1 - SQLi Zomplog 3.9 - Cross-site scripting (XSS) zomplog 3.9 - Remote Code Execution (RCE) copyparty 1.8.2 - Directory Traversal copyparty v1.8.6 - Reflected Cross Site Scripting (XSS) GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution mRemoteNG v1.77.3.1784-NB - Cleartext Storage of Sensitive Information in Memory Windows/x64 - PIC Null-Free Calc.exe Shellcode (169 Bytes)
37 lines
No EOL
1.4 KiB
Text
37 lines
No EOL
1.4 KiB
Text
# Exploit Title: RosarioSIS 10.8.4 - CSV Injection
|
|
# Google Dork:NA
|
|
# Exploit Author: Ranjeet Jaiswal#
|
|
# Vendor Homepage: https://www.rosariosis.org/
|
|
# Software Link: https://gitlab.com/francoisjacquet/rosariosis/-/archive/v10.8.4/rosariosis-v10.8.4.zip
|
|
# Affected Version: 10.8.4
|
|
# Category: WebApps
|
|
# Tested on: Windows 10
|
|
#
|
|
#
|
|
# 1. Vendor Description:
|
|
#
|
|
# RosarioSIS has been designed to address the most important needs of administrators, teachers, support staff, parents, students, and clerical personnel. However, it also adds many components not typically found in Student Information Systems.
|
|
#
|
|
# 2. Technical Description:
|
|
#
|
|
# A CSV Injection (also known as Formula Injection) vulnerability in the RosarioSIS web application with version 10.8.4 allows malicious users to execute malicious payload in csv/xls and redirect authorized user to malicious website.
|
|
|
|
#
|
|
# 3. Proof Of Concept:
|
|
|
|
3.1. Proof of Concept for CSV injection.
|
|
|
|
# #Step to reproduce.
|
|
Step1:Login in to RosarioSIS 10.8.4
|
|
Step2:Go to Periods page
|
|
Step3:Add CSV injection redirection payload such as "=HYPERLINK("https://www.google.com","imp")"in the Title field
|
|
Step4:click on Save button to save data.
|
|
Step5:Go to export tab and export the data
|
|
Step6:When user open download Periods.xls file.You will see redirection hyperlink.
|
|
Step7:When user click on link ,User will be redirected to Attacker or
|
|
malicious website.
|
|
|
|
|
|
|
|
# 4. Solution:
|
|
Upgrade to latest release of RosarioSIS. |