Ian Dunn · Report #164674
CSV Injection in Camptix
Validstatus
lowseverity
4upvotes
12 Oct 2016disclosed
How it was found
Hello, Ian!
I see you tried to escape "=, -, +, @" in your code (#151516), but let me show simple workaround.
I've made CSV injection by using this string ";=cmd|' /C calc'!A5" without doublequotes.
";" will bypass your trying to set the quote in the beginning of the string.
";" acts as a new cell separator.
Tested in the Excel 2016