CVE-2018-25135 | Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injectio… | CVSS 9.8 CRITICAL

Description

Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing user data.

Metadata

CVE ID: CVE-2018-25135
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2025-12-24 14:28 UTC
Published: 2025-12-24 19:27 UTC
Last updated: 2025-12-24 20:26 UTC
Primary CWE: CWE-149
Improper Neutralization of Quoting Syntax
Vendor / Product: Anviz Biometric Technology Co., Ltd. / Anviz AIM CrossChex Standard
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Anviz Biometric Technology Co., Ltd.	Anviz AIM CrossChex Standard	—	4.3

Weakness (CWE)

CWE	Source	Description
CWE-149	cna	Improper Neutralization of Quoting Syntax

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (3)

ExploitDB-45765 https://www.exploit-db.com/exploits/45765
Anviz Biometric Technology Product Homepage https://www.anviz.com
Zero Science Lab Disclosure (ZSL-2018-5498) https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5498.php