Bagisto CVE-2025-62417

Exploitation requires an attacker able to write product data via Bagisto's Create/Edit Product function (http://.../admin/catalog/products/edit/N) - realistically authenticated admin or seller access unless the store exposes unauthenticated product submission. A privileged user must then invoke a CSV export (product catalog or other affected export functions), and a victim must open the resulting file in spreadsheet software such as Excel. Limiting factors that reduce realistic risk: (1) injection occurs in an authenticated back-office form, not an open public field; (2) the payload only fires after a human performs the export and another human opens the file; (3) reliable impact is data exfiltration via functions like WEBSERVICE/HYPERLINK, while command execution depends on legacy Excel/OLE behavior or users accepting formula-execution security prompts, both mitigated on patched modern spreadsheet software. Fixed in 2.3.8 by neutralizing leading formula characters (=, +, -, @) on CSV generation and import display.

This is a CWE-1236 CSV/formula injection flaw in Bagisto <=2.3.7, rated moderately high (CVSS 4.0 base 7.1). Signal analysis is mixed and leans toward a conditional, operator-dependent risk rather than a top-priority emergency. The vendor's CVSS 4.0 vector uses AV:L and UI:P, correctly recognizing that code/formula evaluation happens on a victim's local spreadsheet application rather than directly over the network - so this is NOT remote unauthenticated server RCE despite the alarming 'remote command execution' language. POC exploit code is publicly available (demonstrating calc.exe launch), which raises practical risk, but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation - treat it as proof-of-concept, not in-the-wild. A key caveat: the vendor rates PR:N, yet the documented injection point is the authenticated admin 'Create/Edit Product' panel, which realistically requires at least low-privilege authenticated access (PR:L) unless the store exposes unauthenticated product submission (e.g., a marketplace/seller onboarding flow) - verify the deployment's input surface. The 'remote command execution' impact is also partly historical: modern Excel hardens most OLE/formula RCE paths, so the reliable impact today is data exfiltration (WEBSERVICE/HYPERLINK callbacks), with RCE conditional on legacy software or users clicking through security prompts. Net: a real, confirmed defect worth patching, but its exploitation chain depends on a privileged export action plus victim behavior, so it is a medium-grade priority rather than a high-CVSS, high-real-risk crisis.

An attacker with access to the product-creation form enters a spreadsheet formula (e.g., =cmd|'/c calc'!A1 or =WEBSERVICE(...)) into the product name field and saves it. Later, a store administrator exports the catalog to CSV and opens it in Excel, at which point the spreadsheet evaluates the crafted formula, enabling data exfiltration via outbound callbacks or, on legacy/misconfigured spreadsheet software, command execution. A public POC demonstrating calc.exe execution exists; attack vector is local to the victim's spreadsheet application (AV:L) and requires the victim to open the exported file (UI).