PT-2022-17741 · Unknown · Surveyking

Strangej · Published 2022-03-24 · Updated 2022-03-30 · CVE-2022-26249

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Survey King version 0.3.0

Description The issue allows attackers to execute arbitrary code or access sensitive information via a CSV injection attack because Survey King does not filter data properly when exporting excel files.

Recommendations For Survey King version 0.3.0, consider implementing proper data filtering when exporting excel files to prevent CSV injection attacks. As a temporary workaround, restrict the export of sensitive information via excel files until a proper fix is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2022-26249

Affected Products

Surveyking

References · 4

• 🔥 https://gitee.com/surveyking/surveyking/issues/I4V05A · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-26249 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26249 · Vendor Advisory
• https://t.me/cibsecurity/39519 · Telegram Post