security - CSV injection msexcel? -


i know csv injection, luckily have website export functionality of csv file trying exploit csv injection,

so tried basic payload i.e.=sum(10+10) , works, that's not enough me read more , found payload i.e. =cmd|' /c calc'!a0 didn't work,

whats problem? can't able open calculator, dont know why, is there update version of msexcel? thats why didn't work

can please suggest me.

thank you


Comments

Post a Comment

Popular posts from this blog

git - TortoiseGit does not show commit log properly -

i using tortoisegit repository on bitbucket. problem when make "show log" in tortoisegit , refresh log still don't see pushed commits in repository. if go bitbucket web page can see them in list of commits not shown in tortoisegit log until make pull. there way see in tortoisegit log commits before making pull ? the bitbucket web page runs in server using git repositories located in server you're looking updated data. tortoisegit runs locally using local repositories, need update repository see updated data. can update repository executing either fetch or pull. see more details fetch , pull here .
Read more

string - Using python and postgres, variables within execute function? -

i had question regarding usage of variables inside python function accesses postgresql server. example, following: def delete(): cur.execute( """delete potluck name = var_1;""" however, if wanted update function take in variables var_1, how so? for example, want function in form: def delete(var_1): cur.execute( """delete potluck name = %s;""", (var_1)) however, typing didn't work. in addition, how in case when: def delete(name, var_1): cur.execute( """delete potluck %s = %s;""", (name, var_1)) where don't want "name" have quotation marks when inserted string? any appreciated! to pass identifiers use psycopg2.extensions.asis from psycopg2.extensions import asis def update(table_name, var_1, var_2): cur.execute(""" update %s set %s = 'y' %s = 'john'; ...
Read more