Spout VS PHPGGC

"This project has been archived and is no longer maintained. No bug fix and no additional features will be added. You won't be able to submit new issues or pull requests, and no additional features will be added" https://github.com/box/spout

We were testing PHP Spreadsheet and Spout (https://github.com/box/spout). We chose Spout because of its low memory footprint. It is using streams so it is much lighter than PHP Spreadsheet, although it is missing quite a bit of features that PHP Spreadsheet has.

The Simple Excel package uses the box/spout package under the hood. In the readme it states that you can get to the underlying writer using ->getWriter().

box/spout: Read and write spreadsheet files (CSV, XLSX and ODS), in a fast and scalable way

If you don't have a lot of formatting requirements beyond just the placement of the data in the correct fields, I really enjoy Box/Spout (https://opensource.box.com/spout/), and they have a way to install it without composer.

I've also had good experiences with https://github.com/box/spout

to add to this, this library is really good when wanting to parse CSV files https://github.com/box/spout

Once we verify that the application uses this library in this specific version (usually through the composer.json file), we can test for insecure deserialization in an image upload route, for example. But first we need to create the gadget with the PHPGGC collection:

I won't explain how to write an exploit for something like this. Some tools can automatically generate a payload for you, and you can call yourself a script kiddie(we all start somewhere). The one I know is PHPGGC. To understand more about the exploit, you can read the OWASP article. If you didn't know this before, also read the rest of the OWASP articles about vulnerabilities

PHPGCC

To achieve RCE you’d need an unserialize “gadget” — PHPGGC might help.