Vulnerabilities > CVE-2020-25445 - Improper Neutralization of Formula Elements in a CSV File vulnerability in Bookingcore Booking Core 1.7.0
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |