PT-2024-10179 · Phpoffice · Phpspreadsheet

Aleksey Solovev · Published 2024-12-23 · Updated 2025-04-21 · CVE-2024-56408

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7

Description The issue is related to the lack of sanitization in the /vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php file, which can lead to a cross-site scripting attack. An attacker can exploit this by sending a specially crafted request to the vulnerable scenario, allowing them to execute arbitrary JavaScript code in the client's browser. The quantity variable is displayed without sanitization, making it possible for an attacker to prepare a special HTML form that will be automatically sent to the vulnerable scenario.

Recommendations For versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7, update to the patched version 3.7.0, 2.3.5, 2.1.6, or 1.29.7 to resolve the issue. As a temporary workaround, consider sanitizing the quantity variable in the /vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php file to prevent cross-site scripting attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-00506

CVE-2024-56408

GHSA-X88G-H956-M5XG

Affected Products

Phpspreadsheet

References · 19

• 🔥 https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-x88g-h956-m5xg · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56408.json · Exploit
• https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-56408 · Security Note
• https://osv.dev/vulnerability/GHSA-x88g-h956-m5xg · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00506 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56408 · Vendor Advisory
• https://github.com/PHPOffice/PhpSpreadsheet · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/a50ebfe118b3ae0ddaea1c48ac19dc38692f4abc · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/b8fac55aa5cb7a3d514c7308378bb37bb711b25e · Note
• https://github.com/PHPOffice/PhpSpreadsheet/commit/9b9a55c7154daa7cd4095f618933c240508ba3c1 · Note
• https://twitter.com/VulmonFeeds/status/1875276521377575226 · Twitter Post
• https://t.me/cvenotify/106221 · Telegram Post
• https://t.me/cvenotify/119199 · Telegram Post
• https://twitter.com/CveFindCom/status/1875218507564044370 · Twitter Post