PT-2023-30970 · Unknown · Time Slots Booking Calendar

Publicado 2023-12-06 · Atualizado 2023-12-09 · CVE-2023-48826

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Time Slots Booking Calendar version 4.0

Description The issue concerns a CSV Injection vulnerability via the unique ID field of the Reservations List. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For Time Slots Booking Calendar version 4.0, as a temporary workaround, consider restricting access to the Reservations List or validating and sanitizing the unique ID field to minimize the risk of CSV Injection exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2023-48826

Produtos afetados

Time Slots Booking Calendar

Referências · 6

• 🔥 http://packetstormsecurity.com/files/176034 · Exploit
• https://osv.dev/vulnerability/CVE-2023-48826 · Aviso do Fabricante
• https://t.me/cvenotify/62679 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-48826 · Nota de Segurança
• https://phpjabbers.com/time-slots-booking-calendar · Nota
• https://twitter.com/CVEnew/status/1732651030016352660 · Publicação no Twitter