CSV Injection Affecting thorsten/phpmyfaq package, versions <2.9.11


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.1% (45th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PHP-THORSTENPHPMYFAQ-72399
  • published16 Sept 2018
  • disclosed2 Sept 2018
  • creditZeel Chavda

Introduced: 2 Sep 2018

CVE-2018-16651  (opens in a new tab)
CWE-74  (opens in a new tab)

How to fix?

Upgrade thorsten/phpmyfaq to version 2.9.11 or higher.

Overview

thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases

Affected versions of this package are vulnerable to CSV Injection. CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program is used to open a CSV, any cells starting with '=' will be interpreted by the software as a formula. Maliciously crafted formulas can be used for three key attacks:

  • Hijacking the user's computer by exploiting vulnerabilities in the spreadsheet software.
  • Hijacking the user's computer by exploiting the user's tendency to ignore security warnings in spreadsheets that they downloaded from their own website
  • Exfiltrating contents from the spreadsheet, or other open spreadsheets.

CVSS Scores

version 3.1