Executive brief
Tendenci is an open-source platform used by non-profits and associations to manage memberships, events, and communications. A vulnerability in the platform's contact form allows attackers to submit messages containing malicious spreadsheet formulas. If an administrator exports these messages to a CSV file and opens it in a program like Microsoft Excel, the attacker could gain control over the administrator's computer, potentially leading to data theft or unauthorized system access.
Technical details
A CSV injection (CWE-1236) vulnerability exists in Tendenci versions prior to 12.3.2. The root cause is the improper neutralization of formula-related characters (such as =, +, -, or @) in the 'message' field of the Contact Us form. An unauthenticated remote attacker can submit a crafted payload, such as '=cmd|' /C calc'!A0', which is stored in the database. When a privileged user exports these form entries into a CSV file and opens it in a spreadsheet application (e.g., Excel, LibreOffice), the application may interpret the payload as a command, leading to arbitrary code execution on the user's workstation. This has been patched in version 12.3.2.
Affected products
- Tendenci Tendenci < 12.3.2
Timeline
- 2020-10-29: disclosed: Vulnerability discovered by researcher
- 2020-12-01: other: Exploit published on Exploit-DB
- 2026-01-28: advisory: GitHub Advisory and NVD publication