PT-2021-11142 · Unknown · Booking Core - Ultimate Booking System

Published 2021-07-14 · Updated 2021-07-16 · CVE-2020-25445

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Ultimate Booking System Booking Core version 1.7.0

Description: The issue concerns the "Subscribe" feature, which is vulnerable to CSV formula injection. This occurs because input containing Excel formulas is not sanitized by the application. As a result, when an administrator downloads and opens the CSV file in the backend, the content of the cells is executed.

Recommendations: For Ultimate Booking System Booking Core version 1.7.0, consider disabling the "Subscribe" feature until a patch is available to prevent CSV formula injection. Restrict access to the CSV download functionality in the backend to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2020-25445

Affected Products

Booking Core - Ultimate Booking System

References · 5

• 🔥 https://medium.com/@singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e · Exploit
• https://osv.dev/vulnerability/CVE-2020-25445 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25445 · Security Note
• https://medium.com/%40singh.satyam158/vulnerabilities-in-booking-core-1-7-d85d1dfae44e · Note
• https://t.me/cvenotify/17626 · Telegram Post