Description
In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fixed in version 1.19.23.5325.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
anuko timetracker
< 1.19.23.5325affected
References
- https://github.com/anuko/timetracker/security/advisories/GHSA-prjf-9mgh-8fpv ↗
- https://github.com/anuko/timetracker/commit/d9472904361495f318c9d0294ffd28acaaeae42f ↗
- http://packetstormsecurity.com/files/159996/Anuko-Time-Tracker-1.19.23.5325-CSV-Injection.html ↗
- https://www.exploit-db.com/exploits/49027 ↗