CVE-2023-54348 - Vulnerability Analysis

Overview

ERPGo SaaS 3.9 contains a CSV injection caused by injection of formula payloads into vendor name fields, letting authenticated attackers execute arbitrary code when exported CSV files are opened in spreadsheet applications.

Severity & Score

Impact

Authenticated attackers can execute arbitrary code on victim machines when opening malicious CSV files.

Mitigation

Update to the latest version that patches this vulnerability.

References

• https://www.vulncheck.com/advisories/erpgo-saas-csv-injection-via-vendor-creation
• https://codecanyon.net/item/erpgo-saas-all-in-one-business-erp-with-project-account-hrm-crm-pos/33263426
• https://rajodiya.com/
• https://www.exploit-db.com/exploits/51220

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner