HackerOne · Report #124223

CSV Injection via the CSV export feature

Validstatus

3upvotes

25 Apr 2016disclosed

How it was found

I've bypassed #111192 by using this string ";=cmd|' /C calc'!A0" without doublequotes. Steps to reproduce are as in #111192. Tested in excel 2003-2013

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original