HexBrain

Ian Dunn · Report #160520

Bypass fix in https://hackerone.com/reports/151516 report.

Validstatus
lowseverity
$100bounty
4upvotes
12 Oct 2016disclosed

How it was found

Hi.

Steps to reproduce:

  1. The same in previous https://hackerone.com/reports/151516 report.
  2. But payload to bypass your fix would be like this: ;=cmd|' /C calc'!A0

Solution:

  1. Add ; in your escape function esc_csv() on line 2858 of camptix.php

References:

  1. https://www.owasp.org/index.php/CSV_Excel_Macro_Injection

Tested on Windows 7 64 + Microsoft Office Exel 2003(think will work and on later versions)

Regards.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original