├── js ├── readme.md └── bootstrap.min.js ├── css ├── readme.md └── bootstrap.min.css ├── Video Demo ├── Readme-Link.rd └── CSV_Injection_Demo.wmv ├── dbconnect.php ├── logout.php ├── README.md ├── excel.php ├── testdb.sql ├── login.php ├── view_record.php ├── index.php └── register.php /js/readme.md: -------------------------------------------------------------------------------- 1 | JS files 2 | -------------------------------------------------------------------------------- /css/readme.md: -------------------------------------------------------------------------------- 1 | CSS file data 2 | -------------------------------------------------------------------------------- /Video Demo/Readme-Link.rd: -------------------------------------------------------------------------------- 1 | https://github.com/securelayer7/csv-injection-vulnerable-php-script-/files/1084173/CSV_Injection_Demo.zip 2 | -------------------------------------------------------------------------------- /Video Demo/CSV_Injection_Demo.wmv: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/securelayer7/csv-injection-vulnerable-php-script-/HEAD/Video Demo/CSV_Injection_Demo.wmv -------------------------------------------------------------------------------- /dbconnect.php: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /logout.php: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | Title : CSV Injection Vulnerable Script 2 | 3 | Author: Ishaq Mohammed 4 | 5 | This is vulnerable PHP script. We have developed this script to demonstrate the CSV injection vulnerability. Feel free to test the vulnerability. 6 | http://blog.securelayer7.net/how-to-perform-csv-excel-macro-injection/ 7 | -------------------------------------------------------------------------------- /excel.php: -------------------------------------------------------------------------------- 1 | 0 && isset($_POST["export_excel"])) 10 | { 11 | 12 | $output = ""; 13 | $sql = "SELECT id, expensetype, amount FROM expense WHERE users_id = ".$login_id." ORDER BY id ASC"; 14 | $result = mysqli_query($con, $sql); 15 | 16 | if ($result && $myrow = mysqli_fetch_array($result)) 17 | { 18 | 19 | $output .= '
| Sr No. | 23 |Expense Type | 24 |Amount | 25 |
|---|---|---|
| '.$sr.' | 34 |'.$myrow['expensetype'].' | 35 |'.$myrow['amount'].' | 36 |
| Sr No. | 65 |Expense Type | 66 |Amount | 67 |
|---|---|---|
| 79 | | 80 | | 81 | |