CVE-2020-36962: medium-severity vulnerability in Tendenci
Tendenci 12.3.1 - CSV/ Formula Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 12%
In short
Tendenci 12.3.1 has a flaw where attackers can insert malicious formulas into contact form messages that execute commands when someone opens the exported CSV file in a spreadsheet application like Excel.
Technical detail
The vulnerability exists in the contact form message field where user input is not sanitized before CSV export. Attackers inject formula payloads (e.g., starting with '=') that are interpreted as executable commands by spreadsheet applications, leading to arbitrary command execution with the privileges of the user opening the file.
Summary generated and translated by AI from the official description.
Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when the CSV is opened in spreadsheet applications.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
Tendenci · Tendenci