CVEvulnerability

CVE-2020-25445

7.8 HIGH Published 2021-07-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-07-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-1236

Description

The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed.

Affected configurations

• bookingcore booking core 1.7.0

Related

Weakness · CWE (1)

  • CWE-1236 Improper Neutralization of Formula Elements in a CSV File weakness

References