GHSA-2p5x-4jr6-x5jg

Summary

Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A low-privilege user (lowpriv) created a customer with nombre = "=SUM(1+1)*cmd|/c calc!A1". An admin then exported ListCliente to CSV via ?action=export&option=CSV. The downloaded file contains the raw payload as the first cell of the nombre column, with no leading single quote and no escape. Excel and LibreOffice will execute the formula on open, including DDE invocations such as =cmd|'/c calc'!A1 that spawn arbitrary processes on the admin workstation.

Core/Lib/Export/CSVExport.php::writeData() wraps every cell in the configured delimiter (") and concatenates without inspecting the first character of the value. Spreadsheet applications interpret a cell that starts with =, +, -, @, \t, or \r as a formula. Because FacturaScripts only sanitises HTML metacharacters (< > " ') on save via Tools::noHtml() (Core/Tools.php:45), the formula prefix characters survive untouched all the way to the export. The downstream consumer is the admin who triggered the export, giving the attacker a reliable handoff: low-priv user plants a payload in any text field that ships in the default list export, admin downloads the CSV (all normal billing/sales/purchasing workflow), and the admin's spreadsheet client runs the formula in the admin's local context.

Details

the export does not neutralise leading meta-characters

Core/Lib/Export/CSVExport.php:253-267:

public function writeData(array $data, array $fields = [])
{
    if (!empty($fields)) {
        $this->writeHeader($fields);
    }

    foreach ($data as $row) {
        $line = [];
        foreach ($row as $cell) {
            $line[] = is_string($cell) ? $this->getDelimiter() . $cell . $this->getDelimiter() : $cell;
        }

        $this->csv[] = implode($this->separator, $line);
    }
}

A string cell is rendered as "<value>". There is no str_starts_with(...) check...