CSV Injection in Wise Chat - #VU29639
Published: July 10, 2020
Vulnerability identifier: #VU29639
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject arbitrary data into CSV files.
The vulnerability exists due to improper input validation when generating CSV files in chat messages. A remote attacker can create specially crafted CSV files and trick the victim into exporting the file with malicious content.
Affected software
Wise Chat
Remediation
Install updates from vendor's website.
Wise Chat - update to 2.8.4
External References
- https://wpvulndb.com/vulnerabilities/10299/
- https://fortiguard.com/zeroday/FG-VD-20-062
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fwise-chat%2Ftags%2F2.8.3%2Fsrc%2Fadmin%2FWiseChatChannelsTab.php&old=2282067&new_path=%2Fwise-chat%2Ftags%2F2.8.4%2Fsrc%2Fadmin%2FWiseChatChannelsTab.php&new=2334501