| 标题 | SourceCodester Pharmacy Sales and Inventory System 1.0 CSV Injection |
|---|
| 描述 | During the security review of "Pharmacy Sales and Inventory System", I discovered a critical CSV Injection vulnerability in the "/Export_csv/export" functionality. This vulnerability stems from insufficient output sanitization when generating CSV exports from the 'create_supplier' table data. Attackers can inject formula payloads into fields such as 'Address' or 'Company Name' through the supplier creation interface. When an administrator exports and opens the CSV file, the embedded formulas are parsed and executed by the spreadsheet application. Successful exploitation allows attackers to exfiltrate data, perform phishing attacks, or execute arbitrary commands depending on the victim's environment. Immediate remedial measures are needed to ensure system security and protect administrative data. |
|---|
| 来源 | ⚠️ https://github.com/timeflies123/cve/issues/6 |
|---|
| 用户 | timeflies (UID 97515) |
|---|
| 提交 | 2026-05-09 06時10分 (5 月前) |
|---|
| 管理 | 2026-05-31 12時15分 (22 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 367526 [SourceCodester Pharmacy Sales and Inventory System 直到 1.0 Supplier Creation Interface /Export_csv/export create_supplier Address/Company Name 权限提升] |
|---|
| 积分 | 20 |
|---|