Input validation

2021-07-1415:15:00

PRIOn knowledge base

www.prio-n.com

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.4%

JSON

The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed.

CPENameOperatorVersion
booking_coreeq1.7.0

CPE	Name	Operator	Version
	booking_core	eq	1.7.0

References

medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e