bypass to csv injection

Disclosed: 2016-09-27 21:45:51 By superngorksky To iandunn-projects
Unknown
Vulnerability Details
Hi Ian, I would like to add payload to this report #151516. payload used: http://google.com?,=2+2-2+3+cmd|' /C calc'!G2 When injecting https://google.com? it will be rendered as a link but when comma (,) it will be rendered in a new cell which will execute the command. Thanks,
Actions
View on HackerOne
Report Stats
  • Report ID: 161290
  • State: Closed
  • Substate: not-applicable
  • Upvotes: 1
Share this report