6.5 CVE-2025-54752
Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.
https://nvd.nist.gov/vuln/detail/CVE-2025-54752
Categories
CWE-1236 : Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) When generating CSV output, ensure that formula-sensitive metacharacters are effectively escaped or removed from all data before storage in the resultant CSV. Risky characters include '=' (equal), '+' (plus), '-' (minus), and '@' (at). If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula. Certain implementations of spreadsheet software might disallow formulas from executing if the file is untrusted, or if the file is not authored by the current user. Low privileged user can trigger CSV injection through a contact form field value Cloud management product allows arbitrary command execution via CSV injection CSV injection in content management system via formula code in a first or last name
References
vultures@jpcert.or.jp
| https://jvn.jp/en/vu/JVNVU93412964/ Third Party Advisory |
| https://www.powercms.jp/news/release-powercms-671-531-461.html Third Party Advisory |
CPE
| cpe | start | end |
|---|---|---|
| Configuration 1 | ||
| cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:* | >= 4.0 | < 4.61 |
| cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:* | >= 5.0 | < 5.31 |
| cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:* | >= 6.0 | < 6.71 |
REMEDIATION
EXPLOITS
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| No known exploits | |||
POC Github
| Url |
|---|
| No known exploits |
Other Nist (github, ...)
| Url |
|---|
| No known exploits |
CAPEC
Common Attack Pattern Enumerations and Classifications
| id | description | severity |
|---|---|---|
| No entry | ||
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
