Mobile Events Manager < 1.4.8 - Admin+ CSV Injection

The plugin does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.

PoC

Export events with malicious CSV: 1. Create and save a new Enquiry source and add the following in the name field: =Calc|A!Z 2. Create and save a new Event with test information and select our malicious CSV payload from the dropdown of “Enquiry source” 3. Victim generate CSV file export and download it Export transaction with malicious CSV: 1. Add transaction & enter 'Paid from" as malicious CSV script =Calc|A!Z & save the transaction 2. Victim generate CSV file export and download it The malicious CSV script is executed when the file is opened by the victim in a spreadsheet application.