PT-2021-11142

Name of the Vulnerable Software and Affected Versions: Ultimate Booking System Booking Core version 1.7.0 Description: The issue concerns the "Subscribe" feature, which is vulnerable to CSV formula injection. This occurs because input containing Excel formulas is not sanitized by the application...

CVE-2020-25445: Improper Neutralization of Formula Elements in a CSV File

The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed...