PT-2025-1511 · Kwhotel · Kwhotel

6En6Ar · Published 2025-01-23 · Updated 2025-02-04 · CVE-2023-46401

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KWHotel version 0.47

Description The issue concerns CSV Formula Injection in the invoice adding function. This allows for potential exploitation through malicious formula injection in CSV files.

Recommendations For KWHotel version 0.47, consider disabling the invoice adding function until a patch is available to prevent CSV Formula Injection. Restrict access to the invoice management module to minimize the risk of exploitation. Avoid using the invoice adding feature with untrusted CSV files until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

BDU:2025-02457

CVE-2023-46401

Affected Products

Kwhotel

References · 8

• 🔥 https://gist.github.com/6en6ar/5d39374d6ced8acbe489e0b1b932d056 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-46401 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46401 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02457 · Security Note
• https://t.me/cvedetector/16244 · Telegram Post
• https://twitter.com/CVEnew/status/1882612839124476272 · Twitter Post
• https://t.me/cvenotify/109999 · Telegram Post
• https://kwhotel.com/download/kwhotel-free · Note