Rajodiya ERPGo SaaS version 3.9 contains a CSV injection vulnerability that could allow an attacker to execute malicious commands.

This vulnerability is a CSV injection flaw (CWE-1236) where an authenticated user with low privileges can inject malicious formula elements into CSV exports.

With a CVSS score of 8.8, this vulnerability allows an authenticated attacker to manipulate data exports that might be opened by administrative users. Successful exploitation could lead to local command execution on the victim's machine, potentially compromising internal business data and local system integrity.

Immediate Action: Contact the vendor for an available patch; if none is available, restrict the ability of low-privileged users to trigger CSV exports.

Proactive Monitoring: Monitor application logs for unusual input patterns during vendor or data creation processes.

Compensating Controls: Implement input validation to sanitize data before it is exported to CSV format to prevent the inclusion of formulaic characters.

Public Exploit Available: Yes — an exploit is available via ExploitDB (ID 51220).

This vulnerability poses a credible risk due to the availability of public exploit code. Administrators should prioritize sanitizing input fields and seek official guidance from Rajodiya to ensure the platform is updated to a secure version.