Vulnerabilities > CVE-2019-11872 - Improper Neutralization of Formula Elements in a CSV File vulnerability in Incsub Hustle
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute malicious code on the administrator's computer through Excel functions as the plugin does not sanitize the user's input and allows insertion of any text.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
References
- https://blog.reddy.io/2019/05/24/reddy-solutions-found-a-csv-injection-vulnerability-in-hustle-wordpress-plugin/
- https://blog.reddy.io/2019/05/24/reddy-solutions-found-a-csv-injection-vulnerability-in-hustle-wordpress-plugin/
- https://blog.reddy.io/category/cybersecurity/
- https://blog.reddy.io/category/cybersecurity/
- https://wordpress.org/plugins/wordpress-popup/#developers
- https://wordpress.org/plugins/wordpress-popup/#developers
- https://wpvulndb.com/vulnerabilities/9326
- https://wpvulndb.com/vulnerabilities/9326