QwikSec

Security Database

CVE

CWE

Training

CVE-2024-9102

Published: Dec 19, 2024

Modified: Apr 16, 2025

PUBLISHED

Description

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this could lead to CSV Formula Injection. NOTE: This vulnerability will not be addressed, the maintainer's position is that it is not the intention of phpLDAPadmin to control what data Administrators can put in their LDAP database, nor filter it on export.

Vendor	Product	Versions
phpLDAPadmin	phpLDAPadmin	affected `1.2.0` affected `1.2.6.7`

Weaknesses (CWE)

References

https://www.redguard.ch/blog/2024/12/19/security-advisory-phpldapadmin/

third-party-advisory

https://github.com/leenooks/phpLDAPadmin/commit/ea17aadef46fd29850160987fe7740ceed1381ad#diff-93b9f3e6d4c5bdacf469ea0ec74c1e9217ca6272da9be5a1bfd711f7da16f9e3R240

https://sourceforge.net/projects/phpldapadmin/files/phpldapadmin-php5/1.2.0

https://github.com/leenooks/phpLDAPadmin/issues/274#issuecomment-2586859072

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.