PT-2023-30970 · Unknown · Time Slots Booking Calendar

Published 2023-12-06 · Updated 2023-12-09 · CVE-2023-48826

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Time Slots Booking Calendar version 4.0

Description The issue concerns a CSV Injection vulnerability via the unique ID field of the Reservations List. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For Time Slots Booking Calendar version 4.0, as a temporary workaround, consider restricting access to the Reservations List or validating and sanitizing the unique ID field to minimize the risk of CSV Injection exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2023-48826

Affected Products

Time Slots Booking Calendar

References · 6

• 🔥 http://packetstormsecurity.com/files/176034 · Exploit
• https://osv.dev/vulnerability/CVE-2023-48826 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48826 · Security Note
• https://t.me/cvenotify/62679 · Telegram Post
• https://phpjabbers.com/time-slots-booking-calendar · Note
• https://twitter.com/CVEnew/status/1732651030016352660 · Twitter Post