CVE-2020-25445

The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection

published July 14, 2021

CVSS
—
EPSS
1%
Percentile
59.3
In the wild
Unconfirmed
What it is

The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00898 · 59.3th percentile
Published
2021-07-14T14:40Z
EPSS history
Timeline
  • 14 JUL 14:40Z
    The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection
    cvelistv5