Anviz AIM CrossChex Standard contains a critical CSV injection vulnerability that allows attackers to achieve remote code execution through malicious data imports.

The application is susceptible to CSV injection (CWE-149) because it fails to sanitize user-supplied input in fields such as 'Name' or 'Position', allowing for the injection of Excel formulas that trigger malicious code execution upon file opening.

Exploitation of this flaw can lead to full system compromise, allowing an attacker to gain control over the host workstation or server. Given the 9.8 CVSS score, this is a critical threat that could lead to data theft, lateral movement within the network, and complete loss of system integrity.

Immediate Action: Disable or restrict the import of untrusted CSV files into the CrossChex software until a formal patch is applied.

Proactive Monitoring: Audit logs for suspicious user import activity and monitor for unexpected process execution originating from Excel or the CrossChex application.

Compensating Controls: Advise end-users to never open CSV files from untrusted sources in spreadsheet software and configure security policies to disable Excel macros by default.

Public Exploit Available: Yes — a public exploit is available via ExploitDB (45765).

This vulnerability presents a severe risk of code execution. Organizations should treat any data import into this software as a high-risk activity and implement strict administrative controls to prevent the processing of malicious CSV files until the vendor provides a secure update.