Sarun Pornjarungsak

A formula injection issue exists, allowing an authenticated remote attacker with administrative privileges to manipulate application form fields. This could trick another administrator into executing CSV payloads.

An arbitrary file write issue exists, allowing an authenticated, remote attacker with administrator privileges to alter logging variables. This could result in overwriting arbitrary files on the remote host with log data, potentially leading to a denial of service condition.

The issue is related to insufficient input validation, which can be exploited by a remote attacker to elevate privileges to root or NT AUTHORITY/SYSTEM on the Nessus host. This can be achieved by executing a specially crafted file.