2 ms·
It prompts about enabling macros, generally. I haven't tested in the most recent versions of Excel but we see this about once a year at clients. You can test it
by BeefWellington 5y ago
It prompts about enabling macros, generally. I haven't tested in the most recent versions of Excel but we see this about once a year at clients. You can test it yourself by with a test CSV like:
MYNAME,=cmd|' /c calc.exe'!'B1',AVALUE
Further reading:
- https://owasp.org/www-community/attacks/CSV_Injection https://owasp.org/www-community/attacks/CSV_Injection
- https://github.com/payloadbox/csv-injection-payloads https://github.com/payloadbox/csv-injection-payloads
- jph00 5y agoI just tried that CSV in Excel for Windows and it gave two warnings about it being insecure, had the disabled button default each time, and even 'enable' each time it still didn't run that cell.