CVE-2025-9241: Eladmin CSV Injection Vulnerability

CVE-2025-9241 Overview

CVE-2025-9241 is a CSV injection vulnerability affecting elunez eladmin versions up to 2.7. The flaw resides in the exportUser function, which writes user-controlled data into exported CSV files without proper neutralization of formula characters. An authenticated remote attacker can inject spreadsheet formulas that execute when a victim opens the exported file in a spreadsheet application. The issue is tracked under CWE-74: Improper Neutralization of Special Elements in Output. The exploit details have been disclosed publicly through the project issue tracker.

Critical Impact
Attackers with low privileges can plant malicious formulas in exported user data, leading to client-side code execution, data exfiltration, or command execution when a recipient opens the CSV in Microsoft Excel or compatible software.

Affected Products

elunez eladmin versions up to and including 2.7
exportUser export functionality
Deployments exposing administrative user export to low-privileged accounts

Discovery Timeline

2025-08-20 - CVE-2025-9241 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-9241

Vulnerability Analysis

The vulnerability exists in the exportUser function of eladmin, a Spring Boot administrative backend. The function generates a CSV file from user records stored in the database. Field values are concatenated into CSV rows without sanitizing characters that spreadsheet applications interpret as formulas, such as =, +, -, @, and tab or carriage return prefixes.

When a user with permission to modify their own profile or other writable fields inserts a payload like =cmd|'/c calc'!A1, the value is stored verbatim. An administrator who later exports user data and opens the resulting CSV triggers formula evaluation in the spreadsheet client. The attack pivots from a web application input into client-side execution on the analyst's workstation.

Root Cause

The root cause is the absence of output encoding for CSV-sensitive characters in the export pipeline. CSV is a data format, not a code format, but spreadsheet applications treat leading =, +, -, and @ characters as formula indicators. The eladmin export logic writes attacker-controlled strings directly to the response stream without prefixing dangerous values with a single quote or otherwise neutralizing the leading character.

Attack Vector

The attack requires network access to the eladmin web interface and a low-privileged authenticated session. An attacker submits crafted input through any field that flows into the user export, such as username, nickname, email, or phone fields. The malicious payload remains dormant until an administrator invokes the export feature. Opening the resulting CSV in a vulnerable client interprets the embedded formula, which can invoke external programs, exfiltrate cell data over DDE or web requests, or display deceptive content.

No verified proof-of-concept code is published in a reference repository. Technical analysis is available in GitHub Issue #886 and the VulDB entry #320774.

Detection Methods for CVE-2025-9241

Indicators of Compromise

User profile fields containing values that begin with =, +, -, @, tab, or carriage return characters
Exported CSV files from eladmin that include cells starting with formula characters such as =HYPERLINK, =cmd, =DDE, or =WEBSERVICE
Outbound network connections from spreadsheet processes (excel.exe, soffice.bin) shortly after opening an export file
Endpoint alerts for child processes spawned by spreadsheet applications, including cmd.exe, powershell.exe, or mshta.exe

Detection Strategies

Inspect database tables backing eladmin users for stored values whose first character matches CSV formula triggers
Static-scan generated export files in CI or staging environments and flag rows containing leading formula characters
Correlate web application logs showing profile update requests against subsequent export operations performed by administrators

Monitoring Recommendations

Monitor process lineage where Microsoft Excel or LibreOffice Calc spawns interpreters or networking utilities
Log all invocations of the exportUser endpoint, capturing the requesting account and the row count returned
Alert when administrative export operations occur outside change windows or from unusual source addresses

How to Mitigate CVE-2025-9241

Immediate Actions Required

Restrict access to the exportUser function to a minimal set of trusted administrative roles
Sanitize existing user records by prefixing any field beginning with =, +, -, or @ with a single quote before re-exporting
Instruct administrators to open exported CSVs in a text editor first, or to import them with formula evaluation disabled

Patch Information

No official patch is referenced in the NVD entry at the time of publication. Track remediation progress through elunez/eladmin GitHub Issue #886. Until a vendor fix is released, apply application-layer input filtering and output encoding within the export pipeline.

Workarounds

Modify the CSV export routine to prefix any cell beginning with =, +, -, @, \t, or \r with a single quote character
Configure Microsoft Excel Trust Center to disable Dynamic Data Exchange and external content for files originating from the internet
Enforce input validation at registration and profile update endpoints to reject leading formula characters in name, email, and free-text fields
Replace CSV exports with XLSX generated through a library that writes values as strings rather than formulas

bash

# Configuration example: pre-export sanitization in a shell pipeline
# Prefix any cell starting with =, +, -, or @ with a single quote
awk 'BEGIN{FS=OFS=","} {
  for (i=1; i<=NF; i++) {
    if ($i ~ /^[=+\-@\t\r]/) {
      $i = "\\x27" $i
    }
  }
  print
}' users_export_raw.csv > users_export_safe.csv