https://bugs.limesurvey.org/view.php?id=19252

========
When using a spreadsheet program like Microsoft Excel or LibreOffice Calc to open a CSV file, the software interprets any cell that begins with "=" as a formula. CSV injection, also known as formula injection, occurs when websites incorporate user-supplied data into CSV files without proper validation.

It has been detected the possibility of injecting CSV formulas into the titles of survey quotas, which can subsequently be exported to CSV.

To mitigate this vulnerability, it is recommended to validate the input entered by a user to ensure that no cell begins with any of the following characters:

Equal to ("=")
Plus ("+")
Minus ("-")
At ("@")"

On its own, this functionality would not have a high impact, as the CSV quotas can only be exported by the same user. However, considering the vulnerability which allows the editing of quotas belonging to others, an attacker could add malicious formulas to another user, which would be executed when that user exports their quotas.

5.png (90,281 bytes)   

5.png (90,281 bytes)