CSV Injection vulnerability in ChurchCRM version 4.2.0, allows remote attackers to execute arbitrary code via crafted CSV file.
**Vulnerability Name:** CSV Injection/ Formula Injection
**Severity:** High
**Description:** CSV Injection (aka Excel Macro Injection or Formula Injection) exists in List Event Types feature in ChurchCRM v4.2.0 via Name field that is mistreated while exporting to a CSV file.
**Impact:** Arbitrary formulas can be injected into CSV files which can lead to remote code execution at the client or data leakage via maliciously injected hyper-links.
**Version Affected:** 4.2.0
**Payload Used:** =10+20+cmd|' /C calc'!A0
**Vulnerable URL:** master/EventNames.php
**Vulnerable Parameters:** Name
**Steps to Reproduce:** 

1. Login to the application, goto 'Events' module and then "List Event Types"
2. Edit any event  and inject the payload =10+20+cmd|' /C calc'!A0 in the 'Name' field
3. Now goto 'List Event types' module and click CSV to download the CSV file
4. Open the CSV file, allow all popups and our payload is executed (calculator is opened).
![2020-10-24 10_28_13-](https://user-images.githubusercontent.com/20786373/97068288-e8a7c280-15e3-11eb-85ef-4713488f5de5.png)
![2020-10-24 10_28_50-ChurchCRM Edit Event Types (4) csv - Excel](https://user-images.githubusercontent.com/20786373/97068304-f0fffd80-15e3-11eb-9dc5-579c475231a4.png)

**Note:** Incase the payload does not execute, then enable 'External Content' and 'Macro' settings in Excel. Goto Excel > File > Options > Trust Center > Trust Center Settings > Macro/External Content.
**References:**
https://nvd.nist.gov/vuln/detail/CVE-2019-12134
http://cwe.mitre.org/data/definitions/1236.html


CSV Injection Vulnerability
This is a GitHub Issue
repo:CRM
owner:ChurchCRM
Title : CSV Injection Vulnerability
Issue date:

--- start body ---
**Vulnerability Name:** CSV Injection/ Formula Injection
**Severity:** High
**Description:** CSV Injection (aka Excel Macro Injection or Formula Injection) exists in List Event Types feature in ChurchCRM v4.2.0 via Name field that is mistreated while exporting to a CSV file.
**Impact:** Arbitrary formulas can be injected into CSV files which can lead to remote code execution at the client or data leakage via maliciously injected hyper-links.
**Version Affected:** 4.2.0
**Payload Used:** =10+20+cmd|' /C calc'!A0
**Vulnerable URL:** master/EventNames.php
**Vulnerable Parameters:** Name
**Steps to Reproduce:** 

1. Login to the application, goto 'Events' module and then "List Event Types"
2. Edit any event  and inject the payload =10+20+cmd|' /C calc'!A0 in the 'Name' field
3. Now goto 'List Event types' module and click CSV to download the CSV file
4. Open the CSV file, allow all popups and our payload is executed (calculator is opened).
![2020-10-24 10_28_13-](https://user-images.githubusercontent.com/20786373/97068288-e8a7c280-15e3-11eb-85ef-4713488f5de5.png)
![2020-10-24 10_28_50-ChurchCRM Edit Event Types (4) csv - Excel](https://user-images.githubusercontent.com/20786373/97068304-f0fffd80-15e3-11eb-9dc5-579c475231a4.png)

**Note:** Incase the payload does not execute, then enable 'External Content' and 'Macro' settings in Excel. Goto Excel > File > Options > Trust Center > Trust Center Settings > Macro/External Content.
**References:**
https://nvd.nist.gov/vuln/detail/CVE-2019-12134
http://cwe.mitre.org/data/definitions/1236.html


--- end body ---
