Design/Logic Flaw

LiteCart through 2.2.1 allows CSV injection via a customer's profile...