CVE-2023-53905ProjectSend r1605 CSV Injection via User Account Export Functionality

Beschreibung

ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV files.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• ExploitDB-51517 exploitExploitThird Party Advisory
• Official Product Homepage productProduct
• VulnCheck Advisory: ProjectSend r1605 CSV Injection via User Account Export Functionality third-party-advisoryThird Party Advisory