Description
Formula Injection/CSV Injection in “Task” due to Improper Neutralization of Formula Elements in CSV File.
Proof of Concept
- Click on plus track button
- Under the task input field enter the payloads
=1+1
- Now enter the work hour as
2
- Then click on save
- Now go to details and click on CSV and the csv will be downloaded.
Video POC
https://drive.google.com/file/d/1AqXmJpt0N5C-6saL59MKxYGLQfM3nE1u/view?usp=sharing