CVE-2023-53929
CSV Injection in phpMyFAQ 3.1.12 Enables Remote Code Execution
Publication date: 2025-12-17
Last updated on: 2025-12-18
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| phpmyfaq | phpmyfaq | 3.1.12 |
| phpmyfaq | phpmyfaq | 4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1236 | The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a CSV injection in phpMyFAQ 3.1.12 that allows authenticated users to insert malicious formulas into their profile names. When an administrator exports user data as a CSV file, these formulas can be executed, potentially triggering code execution on the administrator's system.
How can this vulnerability impact me? :
The vulnerability can lead to code execution on the administrator's machine when they export user data as a CSV file containing malicious formulas injected by an attacker. This can result in unauthorized actions, data compromise, or system control by the attacker.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if any user profile names contain suspicious CSV formula payloads such as '=calc|a!z|'. You can inspect the database or user profile data for usernames starting with characters like '=', '+', '-', or '@' which are commonly used in CSV injection attacks. For example, you can run a SQL query to find such usernames: SELECT username FROM users WHERE username LIKE '=%%' OR username LIKE '+%%' OR username LIKE '-%%' OR username LIKE '@%%'; Additionally, monitoring exported CSV files for unsanitized user input can help detect exploitation attempts. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include sanitizing or escaping user input before exporting it to CSV files to prevent formula injection. Restrict or validate characters in usernames to disallow formula prefixes such as '=', '+', '-', or '@'. Additionally, update phpMyFAQ to a version that addresses this vulnerability, such as the newer 4.x releases mentioned in the resources. Educate administrators to be cautious when opening CSV exports from untrusted sources and consider disabling automatic formula evaluation in spreadsheet software. [1, 2, 3]