CSV Excel Macro Injection in Export Response
该报告还没有中文解读。
原文摘录
摘自原文（1403 字符中的一小部分）
Scenario: An attacker creates a response like =AND(2>1) in a tour that allows open response or discussion. Then when a user who created this tour clicks analytic and clicks to export responses as csv, he will see TRUE instead of =AND(1>2) Meaning that cell is now active, and an attacker could make …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Zaption 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @alyssa_herrera · 版权归作者与 Zaption 所有