CVE-2022-44830

Deeper analysis

Sourcecodester Event Registration App v1.0 contains multiple CSV injection vulnerabilities, tracked as CVE-2022-44830 and assigned CWE-1236, that affect the First Name, Contact, and Remarks fields. The issues permit an attacker to supply crafted input that is later exported in CSV format and interpreted as formulas when the file is opened in spreadsheet software, resulting in arbitrary code execution. The vulnerability received a CVSS 3.1 score of 7.8 with an attack vector of local access, low complexity, no privileges required, and user interaction needed.

An unauthenticated attacker can supply malicious payloads through the affected registration fields. When an administrator or other user exports the data and opens the resulting CSV file in a spreadsheet application such as Microsoft Excel, the injected formulas execute with the privileges of the user who opened the file, potentially leading to full compromise of the local system.

Public references consist of proof-of-concept repositories that demonstrate the injection vectors but contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score has remained flat at 0.0653 with no material increase since disclosure.