Exploitation Summary
EIP tracks 1 public exploit for CVE-2023-54348. PoCs published by Sajibe Kanti.
AI-analyzed exploit summary This exploit demonstrates a CSV injection vulnerability in ERPGo SaaS 3.9, where a malicious payload in a vendor name field triggers command execution when the CSV is opened in Excel. The PoC shows a calculator being launched via a crafted formula.
Description
ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas into vendor name fields that execute on the workstation of users who open the exported CSV in a spreadsheet application. Attackers can add malicious formulas like =10+20+cmd|' /C calc'!A0 in the vendor creation form, which execute when the exported CSV file is opened in spreadsheet applications.
Exploits (1)
This exploit demonstrates a CSV injection vulnerability in ERPGo SaaS 3.9, where a malicious payload in a vendor name field triggers command execution when the CSV is opened in Excel. The PoC shows a calculator being launched via a crafted formula.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H