Description
Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can craft payloads like =calc|a!z| to trigger code execution when an admin exports customer data as a CSV file.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Rukovoditel | Rukovoditel | 3.3.1 | — |
References
- ExploitDB-51490 exploit
- Official Product Webpage product
- VulnCheck Advisory: Rukovoditel 3.3.1 CSV Injection via User Account Export third-party-advisory