Threats tagged 'ghsa-jrr2-f5c5-j7qw'

MRBS versions prior to 1.13.0 have a CSV formula injection vulnerability that allows authenticated users to inject malicious spreadsheet formulas. This occurs because the escape() function in web/report.php does not properly neutralize leading formula characters. Attackers can embed formulas in booking names, descriptions, or custom fields that execute when privileged users open exported CSV reports, potentially leading to data exfiltration or command execution via DDE.