Sign In
Advisories

Anviz AIM CrossChex Standard 4.3.6.0 CSV Injection via User Import

Go Back
severity
critical
date
Affecting

  • Anviz AIM CrossChex Standard 4.3

CWE
  • CWE-149 Improper Neutralization of Quoting Syntax
CVSS
9.3
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Credit
LiquidWorm as Gjoko Krstic of Zero Science Lab
Description
Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing user data.