CVE-2023-33410

HIGH

Minical <= 1.0.0 - CSV Injection via Customer Name Field

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-33410. PoCs published by Thirukrishnan.

AI-analyzed exploit summary This PoC demonstrates a CSV Injection vulnerability in Minical 1.0.0, where a malicious payload is injected into the Name field of the Accounting module, which then gets rendered when a CSV report is downloaded.

Description

Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is used to construct a CSV file.

Exploits (1)

nomisec WORKING POC
by Thirukrishnan · poc
https://github.com/Thirukrishnan/CVE-2023-33410

This PoC demonstrates a CSV Injection vulnerability in Minical 1.0.0, where a malicious payload is injected into the Name field of the Accounting module, which then gets rendered when a CSV report is downloaded.

Classification
Working Poc 90%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: Minical 1.0.0
Auth required
Prerequisites: Access to the Accounting module · Ability to create a new customer
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory
https://github.com/Thirukrishnan/CVE-2023-33410

Scores

CVSS v3 8.8
EPSS 0.0116
EPSS Percentile 63.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-1236
Status published
Products (1)
minical/minical 1.0.0
Published Jun 05, 2023
Tracked Since Feb 18, 2026