bypass to csv injection
I
Ian Dunn
Submitted None
Actions:
Reported by
superngorksky
Vulnerability Details
Technical details and impact analysis
Hi Ian,
I would like to add payload to this report #151516.
payload used:
http://google.com?,=2+2-2+3+cmd|' /C calc'!G2
When injecting https://google.com? it will be rendered as a link but when comma (,) it will be rendered in a new cell which will execute the command.
Thanks,
Report Details
Additional information and metadata
State
Closed
Substate
Not-Applicable
Submitted
Weakness
Command Injection - Generic