Executive brief
Poweradmin is a web-based management tool for PowerDNS servers. A vulnerability in its log export feature allows malicious users to insert spreadsheet formulas into their usernames. When an administrator exports these logs and opens them in software like Excel or Google Sheets, the formulas execute automatically, which could lead to the theft of sensitive data or the redirection of the administrator to malicious websites.
Technical details
Poweradmin versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (CWE-1236) within the log export controllers (e.g., ListLogUsersController.php). The application uses fputcsv() to generate exports but fails to sanitize formula trigger characters (=, +, -, @) in the username field. An attacker with 'user_add_new' permissions can create a user with a malicious formula as a username. When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Excel, LibreOffice Calc, Google Sheets), the formula executes. This can be leveraged for data exfiltration via functions like IMPORTXML or for phishing via HYPERLINK. The issue is patched in versions 4.2.4 and 4.3.3.
Affected products
- poweradmin Poweradmin < 4.2.4, >= 4.3.0 < 4.3.3
Timeline
- 2026-06-07: patched: Versions 4.2.4 and 4.3.3 released
- 2026-06-23: disclosed: Public advisory published