PT-2026-37003 · Unknown · Erpgo Saas

Sajibe Kanti · Published 2026-05-05 · Updated 2026-05-05 · CVE-2023-54348

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ERPGo SaaS version 3.9

Description An issue exists where authenticated attackers can execute arbitrary code by injecting formula payloads into vendor name fields. This occurs when malicious formulas are entered into the vendor creation form and subsequently executed when the exported CSV file is opened in spreadsheet applications.

Recommendations As a temporary workaround, restrict the use of the vendor creation form or sanitize inputs in the vendor name field to prevent the use of formula characters until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2023-54348

Affected Products

Erpgo Saas

References · 6

• 🔥 https://exploit-db.com/exploits/51220 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-54348 · Security Note
• https://t.me/cveNotify/162161 · Telegram Post
• https://vulncheck.com/advisories/erpgo-saas-csv-injection-via-vendor-creation · Note
• https://codecanyon.net/item/erpgo-saas-all-in-one-business-erp-with-project-account-hrm-crm-pos/33263426 · Note
• https://rajodiya.com · Note