Fallos del tipo CWE-1236

204 resultados

Falta de neutralização de fórmulas em arquivos CSV

Quando um arquivo CSV contém fórmulas (como =cmd|'/c calc'!A1 ou =1+1), aplicativos que abrem o arquivo automaticamente as interpretam e executam, permitindo injeção de código. O risco é alto porque o usuário apenas abre um arquivo aparentemente inofensivo e o aplicativo (Excel, Calc, etc.) executa comandos maliciosos sem aviso adequado.

Ejemplo

Um relatório exportado em CSV com dados de usuários contém um campo começando com '=' que, quando aberto no Excel, executa uma macro ou comando do sistema. Um atacante injeta a fórmula no banco de dados ou upload de arquivo, e qualquer pessoa que baixe e abra o CSV sofre o ataque.

Cómo mitigar

Prefixe campos suspeitos com um caractere neutro (como aspas simples ou espaço) antes de gerar o CSV, ou configure o aplicativo para não interpretar fórmulas automaticamente. Na aplicação, valide e escape qualquer conteúdo que inicie com caracteres de fórmula (=, +, -, @, tabulação).

CVE-2025-39245MEDIUMThere is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands vEPSS 0.4%CVE-2025-51735HIGHCSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.EPSS 0.4%CVE-2026-79971MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper SanitizaEPSS 0.4%CVE-2026-86745MEDIUMSnipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping ExportEPSS 0.4%CVE-2023-54348HIGHERPGo SaaS 3.9 CSV Injection via Vendor CreationEPSS 0.4%CVE-2026-76797MEDIUMMongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated ReportsEPSS 0.4%CVE-2025-14229MEDIUMSourceCodester Inventory Management System SVC Report Export csv injectionEPSS 0.4%CVE-2026-111038HIGHMultiple vulnerabilities in Coupa’s Total Spend Management PlatformEPSS 0.3%CVE-2025-7061MEDIUMIntelbras InControl operador csv injectionEPSS 0.3%CVE-2025-11254MEDIUMContest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV InjectionEPSS 0.3%CVE-2023-47022MEDIUMInsecure Direct Object Reference in NCR Terminal Handler v.1.5.1 allows an unprivileged user to edit the audit logs for any user and can leaEPSS 0.3%CVE-2025-1836MEDIUMIncorta Edit Insight csv injectionEPSS 0.3%CVE-2026-54243MEDIUMStatamic: CSV formula injection in form submission exportsEPSS 0.3%CVE-2025-8767MEDIUMAnWP Football Leagues <= 0.16.17 - Authenticated (Administrator+) CSV InjectionEPSS 0.3%CVE-2025-9241MEDIUMelunez eladmin exportUser csv injectionEPSS 0.3%CVE-2023-29109MEDIUMCode Injection vulnerability in SAP Application Interface Framework (Message Dashboard)EPSS 0.3%CVE-2026-35157MEDIUMDell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula eleEPSS 0.3%CVE-2025-8808MEDIUMxujeff tianti 天梯 com.jeff.tianti.controller save exportOrder csv injectionEPSS 0.3%CVE-2025-66834HIGHA CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into expEPSS 0.3%CVE-2025-11498MEDIUMCSV Formula Injection VulnerabilityEPSS 0.3%