Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @ characters that execute when administrators or video owners open the exported CSV file in spreadsheet applications.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-11T12:16:54.423Z",
  "pubdate": "2026-09-11T12:16:54.423Z",
  "executiveSummary": "WWBN AVideo, up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, is susceptible to a CSV Formula Injection vulnerability within the myComments.download.php endpoint. This flaw arises from the application's failure to properly sanitize user-supplied input contained within comment fields before exporting them into CSV format.\nA remote, authenticated attacker can craft malicious comments containing spreadsheet formula prefixes such as '=', '+', '-', or '@'. When an administrator or privileged user exports these comments and opens the resulting CSV file in a spreadsheet application, the embedded formulas are interpreted and executed by the software.\nThis vulnerability poses a significant risk, as it can be leveraged to achieve arbitrary code execution on the victim's workstation, exfiltrate sensitive data, or trigger unauthorized network requests, depending on the spreadsheet software's configuration and security settings. Successful exploitation requires the attacker to possess an authenticated account on the AVideo instance and rely on a privileged user to download and open the malicious CSV file.",
  "technicalDetails": "The vulnerability is situated in the myComments.download.php component of WWBN AVideo. The application functionality provides a mechanism for users to export comment data into a CSV format. The root cause of this vulnerability is the lack of input sanitization and output encoding for user-provided data within comment fields. Specifically, the application concatenates user-supplied comment text directly into the CSV structure without verifying or neutralizing characters that initiate spreadsheet formulas.\nIn spreadsheet applications such as Microsoft Excel, LibreOffice Calc, or Google Sheets, cells starting with characters like '=', '+', '-', or '@' are treated as executable formulas rather than static text. By injecting these characters into the 'comment' field, an attacker can coerce the spreadsheet software to interpret subsequent text as function calls.\nThe attack flow proceeds as follows: 1) An authenticated attacker submits a comment containing a malicious payload (e.g., '=cmd|'/C calc'!A0' or similar DDE-style injection strings) through the standard AVideo comment interface. 2) The malicious string is stored in the application database without sanitization. 3) An administrator or a video owner with sufficient privileges navigates to the dashboard and initiates a CSV export of the comments. 4) The myComments.download.php endpoint generates a CSV file containing the malicious payload in the comment column. 5) When the victim opens the file in a spreadsheet program, the application parses the cell content, identifies the leading formula character, and executes the embedded command or function.\nThe impact is significant, as it facilitates a client-side execution attack. Because the spreadsheet software operates with the permissions of the user who opened the file, an attacker could potentially execute system-level commands, initiate outbound connections to attacker-controlled infrastructure (potentially leaking internal network information), or perform unauthorized data manipulation. The vulnerability is persistent and remains within the database until manually removed. This threat is exacerbated by the fact that many users trust exported reports generated by administrative portals, making them less likely to scrutinize the raw content of the CSV file prior to opening it."
}