Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC — This repository contains a Proof of Concept (PoC) for a CSV Injection (Formula Injection) vulnerability (CVE-2025-60852) affecting applications built with the Instant Developer Foundation framework (versions prior to 25.0). | Kitploit
Tools/GitHubGitHub/valeriocassoni/csv-injection-in-instant-developer-foundation-25.0-poc
Vulnerability AnalysisExploitationWeb Application ExploitationData ExfiltrationPenetration TestingLearning & Education
GitHubvaleriocassoni/csv-injection-in-instant-developer-foundation-25.0-poc

CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC

This repository contains a Proof of Concept (PoC) for a CSV Injection (Formula Injection) vulnerability (CVE-2025-60852) affecting applications built with the Instant Developer Foundation framework (versions prior to 25.0).

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
View Repository
10 months agoNot yet reviewed

CVE-2025-60852: CSV Injection in Instant Developer Foundation (< 25.0.9600) – Proof of Concept (PoC)

📌 Overview

This repository contains a Proof of Concept (PoC) for a CSV Injection (Formula Injection) vulnerability (CVE-2025-60852) affecting applications built with the Instant Developer Foundation framework (versions prior to 25.0.9600). Applications built with the vulnerable framework do not properly sanitize user-supplied input when exporting data in CSV format.

As a result, spreadsheet software such as Microsoft Excel or LibreOffice Calc interprets certain values as formulas.

Affected Software

  • Framework: Instant Developer Foundation (framework)
  • Affected Versions: < 25.0.9600
  • Patch Status: Fixed in version 25.0.9600.

Vulnerability Details

Observed behavior:

  • Values starting with “+” or “-” are directly reflected in the exported CSV file and are interpreted as formulas when opened in spreadsheet software such as Microsoft Excel or LibreOffice Calc.
  • Values starting with “=” are quoted, suggesting a partial but insufficient mitigation.

Potential Impacts

  • Local command execution (via Excel DDE)
  • Data exfiltration (through HYPERLINK)
  • Data manipulation in spreadsheets

Proof of Concept (PoC)

Insert the following payload in any user-controllable input field.

Payload

+CMD|' /C calc'!A0

When the exported CSV file is opened in Excel with DDE launch enabled, the payload triggers execution of calc.exe on Windows.

Steps to Reproduce

  1. Insert the above payload in any user-controllable input field within a table that can be exported in CSV format (in an application built with Instant Developer Foundation < 25.0).

  2. Export the table as CSV.

:/images/CSV_Injection_1.png

  1. Open the exported CSV file in Microsoft Excel or LibreOffice Calc.

  2. If DDE launch is enabled in Excel, the system calculator (calc.exe) is executed.

:/images/CSV_Injection_2.png

🔗 Excel DDE launch documentation

Release notes

🔗 Release Notes: Instant Developer Foundation - Version 25.0.9600

Disclaimer

This PoC has been created strictly for educational and research purposes.
Do not use this against systems or applications without explicit authorization.
The author assumes no liability for any misuse of this material.

 

Download Tool