phpMyFAQ CSV Injection Vulnerability in User Profile Export

A CSV injection vulnerability has been identified in phpMyFAQ version 3.1.12. This issue allows authenticated users to inject malicious formulas into their profile names. When an administrator exports user data as a CSV file, the injected formula is executed, potentially leading to unauthorized actions, such as opening applications like the calculator on the admin's computer.

Impact

Exploitation of this vulnerability allows for CSV injection, where malicious formulas are executed when the CSV file is opened, such as triggering the calculator application.

Reproduction

To reproduce this vulnerability, log in as a user and navigate to the user control panel. Change the profile name to include a payload such as 'calc|a!z|' and save the changes. When an administrator exports the user data as a CSV file, the injected formula will be executed on the admin's computer, demonstrating the CSV injection.