Ian Dunn · Report #160520
Bypass fix in https://hackerone.com/reports/151516 report.
Validstatus
lowseverity
$100bounty
4upvotes
12 Oct 2016disclosed
How it was found
Hi.
Steps to reproduce:
- The same in previous https://hackerone.com/reports/151516 report.
- But payload to bypass your fix would be like this:
;=cmd|' /C calc'!A0
Solution:
- Add
;in your escape function esc_csv() on line 2858 of camptix.php
References:
Tested on Windows 7 64 + Microsoft Office Exel 2003(think will work and on later versions)
Regards.