Cyber Posture

CVE-2023-54348

HighPublic PoC

Published: 05 May 2026

Published
05 May 2026
Modified
05 May 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0007 20.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to execute arbitrary code by injecting formula payloads into vendor name fields. Attackers can add malicious formulas like =10+20+cmd|' /C calc'!A0 in the vendor creation form, which execute…

more

when the exported CSV file is opened in spreadsheet applications.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Validates inputs to the vendor creation form to reject malicious formula payloads before they are stored in the system.

prevent

Filters formula payloads from vendor data during CSV export to prevent arbitrary code execution when opened in spreadsheets.

prevent

Directly addresses remediation of the CSV injection flaw in the vendor name field through identification, reporting, and correction.

Security SummaryAI

CVE-2023-54348 is a CSV injection vulnerability (CWE-1236) affecting ERPGo SaaS version 3.9, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue exists in the vendor creation form, where the vendor name field allows injection of formula payloads that can lead to arbitrary code execution. Published on 2026-05-05, the vulnerability enables attackers to embed malicious formulas, such as =10+20+cmd|' /C calc'!A0, into exported CSV files.

Authenticated attackers with low privileges (PR:L) can exploit this vulnerability by creating a vendor record with a crafted formula in the name field. When another user, such as an administrator, exports a CSV file containing the malicious vendor data and opens it in a spreadsheet application like Microsoft Excel, the formula executes automatically without user interaction (UI:N). This results in arbitrary code execution on the victim's local machine, potentially compromising confidentiality, integrity, and availability with high impact.

Advisories and resources, including the VulnCheck advisory at https://www.vulncheck.com/advisories/erpgo-saas-csv-injection-via-vendor-creation and a proof-of-concept exploit on Exploit-DB at https://www.exploit-db.com/exploits/51220, document the issue. The affected ERPGo SaaS product is available on CodeCanyon at https://codecanyon.net/item/erpgo-saas-all-in-one-business-erp-with-project-account-hrm-crm-pos/33263426 and via https://rajodiya.com/.

Details

CWE(s)

References