typedefabcd1234ntd/cve-2026-19501-pocProof-of-concept for unauthenticated CSV formula injection in SureForms, showing crafted form submissions trigger spreadsheet formulas when exported by admins.
Sureforms is vulnerabale to a unauthenticated CSV injection vulnerability when attacker can inject a CSV formula when submit a form. This formula will be excuted when admin export CSV file and open it.
Step 1: Submit a form and then intercept the submit request
Step 2: Change the body line which include a key "srfm-input..." to
<randomtext>-lbl-<the formula in base 64>: <the content>
Example:
abcdef-lbl-PTIrNStjbWR8JyAvQyBjYWxjJyFBMA==
Step 3: Send the submit request and wait the payload to exploit when admin export and open the CSV file
Updates to the latest version (2.12.3 or later) to solve this issue
Note
If you feel this write-up here great and interesting, you contribute me in my Github Sponsor.