CVE-2020-9372: codepeople appointment_booking_calendar

Vulnerability summary

CVE-2020-9372 is a high (CVSS 7.8) vulnerability in codepeople appointment_booking_calendar. EPSS estimates a 8.61% chance of exploitation in the next 30 days, higher than 95% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 04-03-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.

• CWE-1236Improper Neutralization of Formula Elements in a CSV FileThe product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.