high8.7Public exploit code
CVE-2020-15255
In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as form…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Anuko Time Tracker 1.19.23.5325 - CSV/Formula Injection2020-11-10 · webapps · php
Impact
In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fixed in version 1.19.23.5325.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Anuko | Time Tracker | before 1.19.23.5325 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/159996/Anuko-Time-Tracker-1.19.23.5325-CSV-Injection.html
- https://github.com/anuko/timetracker/commit/d9472904361495f318c9d0294ffd28acaaeae42f
- https://github.com/anuko/timetracker/security/advisories/GHSA-prjf-9mgh-8fpv
- https://www.exploit-db.com/exploits/49027
- http://packetstormsecurity.com/files/159996/Anuko-Time-Tracker-1.19.23.5325-CSV-Injection.html
- https://github.com/anuko/timetracker/commit/d9472904361495f318c9d0294ffd28acaaeae42f
- https://github.com/anuko/timetracker/security/advisories/GHSA-prjf-9mgh-8fpv
- https://www.exploit-db.com/exploits/49027