Test files › Office documents › formula-injection.xlsx
Sample XLSX file
Workbook whose cells contain =, +, - and @ prefixed strings and a HYPERLINK formula.
↓ Download formula-injection.xlsx| Filename | formula-injection.xlsx |
| Format | XLSX |
| Size | 1.7 KB (1,733 bytes) |
| MIME type | application/octet-stream |
| SHA-256 | f3a7e7c4d1b67e339a5e918da7a81a3ac6bdb52f9581f63586774e1dcf8ed10b |
What this file catchesThe XLSX cousin of CSV formula injection. When an app re-exports these cells to CSV, or a spreadsheet opens them, the payloads (all inert - a harmless calculation and a link) can execute. Confirm your export path escapes them.
Download & verify
curl -fsSL -o "formula-injection.xlsx" "https://files.hexaqa.com/office/formula-injection.xlsx"
curl -fsSL "https://files.hexaqa.com/office/formula-injection.xlsx" | sha256sum
# expect: f3a7e7c4d1b67e339a5e918da7a81a3ac6bdb52f9581f63586774e1dcf8ed10b