CyberRota Analysis
AI-GeneratedThe vulnerability affects the gym member TSV export endpoint in wger versions prior to 2.6, where insufficient sanitization of the first_name and last_name fields allows for the injection of malicious spreadsheet formulas. This could lead to data exfiltration or code execution when an admin opens the compromised file in spreadsheet applications like Excel or LibreOffice Calc. Organizations using wger should prioritize patching this vulnerability to mitigate potential risks associated with unauthorized data access and execution of harmful code.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or LibreOffice Calc.