CVE-2023-53905
ProjectSend r1605 CSV Injection via User Account Export Functionality
概要
ProjectSend r1605 CSV Injection via User Account Export Functionality
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV files.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- report exploit-db.com
- web projectsend.org