CSV Chaos: When NopCommerce Exports Go Rogue!
Watch out for CSV Injection in nopCommerce v4.10 and 4.80.3. When exporting data, the app doesn’t sanitize user inputs, allowing attackers to slip malicious formulas into your spreadsheets. Open the file, and voila—your Excel just got a surprise visit from chaos!
Hot Take:
Looks like nopCommerce just hit a “spreadsheet speed bump!” Their CSV files might be the new Trojan horse, carrying not wooden soldiers, but malicious formulas ready to attack your Excel sheets. Time to spreadsheet cautiously, folks!
Key Points:
- CSV Injection vulnerability found in nopCommerce v4.10 and v4.80.3
- Unsanitized user input allows for malicious formula injection into exported CSV files
- Vulnerability affects order details, product names, and customer information
- Malicious formulas execute upon opening CSV in apps like Excel or LibreOffice Calc
- Security disclosure shared via the Full Disclosure mailing list
Already a member? Log in here