Rukovoditel CSV Injection Vulnerability

A CSV injection vulnerability has been identified in Rukovoditel version 3.3.1. This vulnerability allows authenticated users to inject malicious formulas into the firstname field. When an admin exports customer data as a CSV file, these injected formulas can be executed, leading to potential code execution on the admin's computer.

Impact

Exploitation of this vulnerability allows for CSV injection, where injected formulas are executed when the CSV file is opened.

Reproduction

To reproduce this vulnerability, log in as a user and navigate to the 'My Account' section. Inject a payload such as '=calc|a!z|' into the firstname field. When an admin exports customer data as a CSV file, the injected formula will be executed, opening the calculator application on the admin's computer.