CVE-2026-10248
Description
CSV injection in SourceCodester Pharmacy Sales and Inventory System allows attackers to inject malicious formulas via supplier fields, leading to data exfiltration when exported CSV is opened.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
CSV injection in SourceCodester Pharmacy Sales and Inventory System allows attackers to inject malicious formulas via supplier fields, leading to data exfiltration when exported CSV is opened.
Vulnerability
The vulnerability exists in the create_supplier function of /Export_csv/export in SourceCodester Pharmacy Sales and Inventory System up to version 1.0. The system exports supplier data to a CSV file without sanitizing formula characters (e.g., =, +, -, @) in user-supplied fields such as Address and Company Name. This lack of output sanitization leads to CSV injection (formula injection) [1].
Exploitation
An attacker with network access can submit malicious payloads through the supplier creation interface, specifically in the Address or Company Name fields. No authentication is required for this remote exploitation. When an administrator exports the supplier list to CSV and opens it in a spreadsheet application (e.g., Microsoft Excel or WPS Spreadsheet), the injected formulas are automatically executed or presented as clickable hyperlinks [1].
Impact
Successful exploitation can result in data exfiltration (sending sensitive supplier information to external servers), phishing attacks (tricking administrators into clicking malicious links), and in vulnerable environments, potential command execution on the victim's machine. This compromises data confidentiality and system security [1].
Mitigation
As of the publication date (2026-06-01), no official patch has been released by the vendor. Users should sanitize output by escaping formula characters (e.g., prepending a single quote or tab) before CSV export. Alternatively, avoid opening exported CSV files in spreadsheet applications with formula execution enabled. The product may be end-of-life; no fix is currently available [1].
AI Insight generated on Jun 1, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: <=1.0
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Missing sanitization of formula-triggering characters in CSV export allows injection of spreadsheet formulas."
Attack vector
An attacker must first log in to the system, then navigate to the supplier creation form at `/ShowForm/create_supplier/main` and inject a formula payload (e.g., `=1+1` or `=HYPERLINK(...)`) into fields like Address or Company Name. When an administrator exports the supplier list to CSV via `/Export_csv/export` and opens the file in a spreadsheet application (e.g., WPS Spreadsheet or Microsoft Excel), the injected formula is interpreted and executed, enabling data exfiltration, phishing, or arbitrary command execution [ref_id=1].
Affected code
The vulnerability resides in the `/Export_csv/export` endpoint of the SourceCodester Pharmacy Sales and Inventory System V1.0. The `create_supplier` function writes user-supplied fields (Address, Company Name, Mobile, Previous Due) into a CSV file without sanitizing formula-triggering characters such as `=`, `+`, `-`, `@` [ref_id=1].
What the fix does
The advisory recommends sanitizing CSV output by prefixing dangerous characters with a single quote or tab, blocking formula-triggering characters (`=`, `+`, `-`, `@`, `|`, `%`) before writing, and setting secure Content-Type headers. No official patch has been published by the vendor; the suggested repairs involve escaping cell values so that spreadsheet applications treat them as plain text rather than executable formulas [ref_id=1].
Preconditions
- authAttacker must have a valid login to the Pharmacy Sales and Inventory System
- inputAdministrator must export the supplier list to CSV and open it in a spreadsheet application
Reproduction
Step 1: Login to the system and navigate to supplier creation page at `http://localhost/ci_pms/index.php/ShowForm/create_supplier/main`. Step 2: Inject formula payload in the 'Address' field (e.g., `=1+1`). Step 3: Click 'Create' to save the supplier. Step 4: Navigate to the supplier list and click 'Export to CSV'. Step 5: Open the exported CSV file in WPS Spreadsheet. Step 6: Observe that the Address cell displays '2' instead of the literal string `=1+1`, confirming formula injection [ref_id=1].
Generated on Jun 1, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6News mentions
0No linked articles in our index yet.