CVE-2026-10248: Pharmacy Sales System CSV Injection Flaw

CVE-2026-10248 Overview

CVE-2026-10248 is a CSV injection vulnerability in SourceCodester Pharmacy Sales and Inventory System version 1.0. The flaw resides in the create_supplier function within the /Export_csv/export endpoint of the Supplier Creation Interface. Attackers can manipulate the Address and Company Name parameters to embed malicious formulas into exported CSV files. When a user opens the exported file in a spreadsheet application, the injected payload executes within the user's context. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output). Public disclosure of the exploit details has occurred.

Critical Impact
Authenticated remote attackers can inject spreadsheet formulas into CSV exports, leading to potential command execution or data exfiltration when victims open the file.

Affected Products

SourceCodester Pharmacy Sales and Inventory System 1.0
Supplier Creation Interface component
/Export_csv/export CSV export functionality

Discovery Timeline

2026-06-01 - CVE CVE-2026-10248 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10248

Vulnerability Analysis

The vulnerability is a CSV injection flaw triggered through the supplier creation workflow. The create_supplier function accepts user-supplied input for the Address and Company Name fields without neutralizing spreadsheet metacharacters. When an administrator later exports supplier records through /Export_csv/export, the stored values are written into a CSV file without sanitization. Spreadsheet applications such as Microsoft Excel and LibreOffice Calc interpret cells beginning with characters like =, +, -, or @ as formulas. The injected formula then executes when the file is opened, potentially issuing external requests, invoking DDE handlers, or exfiltrating cell data. Exploitation requires high privileges to create supplier entries but no user interaction beyond opening the exported file.

Root Cause

The root cause is missing output neutralization in the CSV export routine. The application stores supplier input verbatim and writes it directly to a CSV cell without prefixing dangerous leading characters with a single quote or stripping formula triggers. This maps to [CWE-74], improper neutralization of special elements in output used by a downstream component.

Attack Vector

An authenticated attacker submits a crafted supplier record where the Address or Company Name field begins with a spreadsheet formula payload such as =cmd|'/C calc'!A1 or =HYPERLINK() referencing an attacker-controlled URL. The malicious entry persists in the application database. When a legitimate administrator exports supplier data and opens the resulting CSV in a spreadsheet client, the formula evaluates. Network reachability to the /Export_csv/export endpoint is required, and the exploit has been publicly disclosed via the GitHub CVE Issue Discussion and VulDB Vulnerability #367526.

No verified proof-of-concept code is available. Refer to the linked advisories for technical payload details.

Detection Methods for CVE-2026-10248

Indicators of Compromise

Supplier records containing values that begin with =, +, -, or @ in the Address or Company Name columns.
CSV files generated by /Export_csv/export containing formula syntax, external references, or HYPERLINK, DDE, or WEBSERVICE calls.
Outbound network connections from workstations immediately after opening exported supplier CSV files.

Detection Strategies

Inspect database tables for supplier rows whose text fields start with spreadsheet metacharacters.
Apply static analysis on CSV exports prior to distribution to flag any cell starting with formula trigger characters.
Correlate spreadsheet process launches (excel.exe, soffice.bin) with subsequent child processes such as cmd.exe, powershell.exe, or scripting interpreters.

Monitoring Recommendations

Log all access to the /Export_csv/export endpoint and review export frequency by privileged users.
Monitor egress traffic from endpoints that routinely open exported CSV reports for unexpected destinations.
Alert on creation or modification of supplier records containing non-printable or formula-leading characters.

How to Mitigate CVE-2026-10248

Immediate Actions Required

Restrict access to the Supplier Creation Interface to trusted administrators until a patch is applied.
Audit existing supplier records and remove or neutralize entries that begin with formula trigger characters.
Instruct staff to open exported CSV files in a text editor before loading them into a spreadsheet application.

Patch Information

No vendor patch is currently listed in the available advisories. SourceCodester has not published a fixed release for Pharmacy Sales and Inventory System 1.0. Monitor the SourceCodester Blog and VulDB CVE entry for updates.

Workarounds

Modify the export routine to prefix any cell value starting with =, +, -, @, tab, or carriage return with a single quote character.
Enforce server-side input validation on the Address and Company Name fields to reject formula trigger characters at submission time.
Configure spreadsheet clients with macro execution and dynamic data exchange (DDE) disabled by default through group policy.

bash

# Configuration example - sanitize CSV cells before export
# Pseudocode for the export routine
sanitize_cell() {
  value="$1"
  case "$value" in
    =*|+*|-*|@*) printf "'%s" "$value" ;;
    *) printf "%s" "$value" ;;
  esac
}