CSV Injection Affecting thorsten/phpmyfaq package, versions <2.9.11



    Attack Complexity Low
    Privileges Required High
    Confidentiality High
    Integrity High
    Availability High
Expand this section
7.2 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • published 16 Sep 2018
  • disclosed 2 Sep 2018
  • credit Zeel Chavda

How to fix?

Upgrade thorsten/phpmyfaq to version 2.9.11 or higher.


thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases

Affected versions of this package are vulnerable to CSV Injection. CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program is used to open a CSV, any cells starting with '=' will be interpreted by the software as a formula. Maliciously crafted formulas can be used for three key attacks:

  • Hijacking the user's computer by exploiting vulnerabilities in the spreadsheet software.
  • Hijacking the user's computer by exploiting the user's tendency to ignore security warnings in spreadsheets that they downloaded from their own website
  • Exfiltrating contents from the spreadsheet, or other open spreadsheets.