CSV Injection

2020-11-0204:35:46

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

42.9%

JSON

tendenci is vulnerable to CSV injection. The Contact Us feature allows an attacker to inject arbitrary CSV formulas and code, which would execute when a user exports the data to a CSV file.

CPENameOperatorVersion
tendencile12.3.1
tendencile12.3.1

CPE	Name	Operator	Version
	tendenci	le	12.3.1
	tendenci	le	12.3.1

References

github.com/tendenci/tendenci/issues/919

sinfosec757.blogspot.com/2019/06/exploit-title-workday-32-csv-injection.html

0.001 Low

EPSS

Percentile

42.9%

JSON

Related for VERACODE:27727