Global infos:

An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal system data from the CSV file to a remote server.

CVE Status: Awaiting Analysis

References:

[email protected]

Metrics:

Attribute	Value
Attack Complexity	LOW
Attack Vector	NETWORK
Availability Impact	HIGH
Base Score	8
Base Severity	HIGH
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Privileges Required	LOW
Scope	UNCHANGED
User Interaction	REQUIRED
Vector String	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Exploitability Score	2.1
Impact Score	5.9
Source	134c704f-9b21-4f2e-91b3-4a467353bcc0
Type	Secondary

Links:

Exploit-db
Github