An attacker can set the Nickname field of a user account to a malicious Excel formula. When an administrator exports the contest rank list via contestrank.xls.php or admin/ranklist_export.php, the application writes the Nickname into an .xls file without sanitization. Because Excel renders the .xls file as an HTML table and evaluates embedded formulas, the malicious formula is executed on the machine that opens the file, enabling arbitrary command execution or data exfiltration.

All versions of HUSTOJ developed by zhblue are affected. The vulnerability resides in the CSV export functionalities of the judging platform.

The CVSS base score is 5.2, indicating a moderate severity. EPSS is under 1%, showing a low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an attacker gains the ability to set a malicious Nickname and that an administrator later export the rank list and open the generated file in Microsoft Excel. Thus, the vulnerability is a local execution vector that can compromise confidentiality, integrity, or availability if the administrator uses a vulnerable system to view exported data.