CVE-2024-9102

Name
CVE-2024-9102
Description
phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
vulnerability@ncsc.ch https://github.com/leenooks/phpLDAPadmin/commit/ea17aadef46fd29850160987fe7740ceed1381ad#diff-93b9f3e6d4c5bdacf469ea0ec74c1e9217ca6272da9be5a1bfd711f7da16f9e3R240
vulnerability@ncsc.ch https://sourceforge.net/projects/phpldapadmin/files/phpldapadmin-php5/1.2.0
third-party-advisory https://www.redguard.ch/blog/2024/12/19/security-advisory-phpldapadmin/
vulnerability@ncsc.ch https://github.com/leenooks/phpLDAPadmin/issues/274#issuecomment-2586859072

Match rules

CPE URI Source package Min version Max version
phpldapadmin == 1.2.0 == 1.2.0
phpldapadmin == 1.2.6.7 == 1.2.6.7

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
phpldapadmin edge-community 1.2.6.7-r1 Leonardo Arena <rnalrd@alpinelinux.org> possibly vulnerable
phpldapadmin 3.22-community 1.2.6.7-r1 Leonardo Arena <rnalrd@alpinelinux.org> possibly vulnerable