PT-2020-20618 · WordPress · Appointment Booking Calendar

Published 2020-03-04 · Updated 2022-01-01 · CVE-2020-9372

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar plugin versions prior to 1.3.35

Description The issue allows user input in fields such as Description or Name in any booking form to be any formula. This input could then be exported via the Bookings list tab in "/wp-admin/admin.php?page=cpabc appointments.php", potentially leading to remote code execution via CSV injection.

Recommendations For versions prior to 1.3.35, update to version 1.3.35 or later to resolve the issue. As a temporary workaround, consider restricting user input in booking forms to prevent the use of malicious formulas until a patch is applied. Avoid using the "/wp-admin/admin.php?page=cpabc appointments.php" endpoint for exporting bookings from untrusted sources until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2020-9372

Affected Products

Appointment Booking Calendar

References · 7

• 🔥 https://exploit-db.com/exploits/48204 · Exploit
• 🔥 https://drive.google.com/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9 · Exploit
• 🔥 http://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-9372 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9372 · Vendor Advisory
• https://hotdreamweaver.com/support/view.php?id=815925 · Note
• https://wordpress.org/plugins/appointment-booking-calendar/#developers · Note