CVE-2023-53905ProjectSend r1605 CSV Injection via User Account Export Functionality

Descripción

ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV files.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• ExploitDB-51517 exploitExploitThird Party Advisory
• Official Product Homepage productProduct
• VulnCheck Advisory: ProjectSend r1605 CSV Injection via User Account Export Functionality third-party-advisoryThird Party Advisory