admin/include/operations.php (via admin/email-harvester.php) in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject untrusted input inside CSV files via the POST parameter data.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10460
Reference (s):
- http://antoniocannito.it/?p=137#csvinj
- https://antoniocannito.it/phpkb1#csv-injection-cve-2020-10460