Vulnerabilities > CVE-2020-9372 - Improper Neutralization of Formula Elements in a CSV File vulnerability in Codepeople Appointment Booking Calendar

CVSS 7.8 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

local

low complexity

codepeople

CWE-1236

NVD

Published: 2020-03-04

Updated: 2022-01-01

Summary

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.

Vulnerable Configurations

Part	Description	Count
Application	Codepeople Codepeople Appointment Booking Calendar 1.0.1 Codepeople Appointment Booking Calendar 1.1.3 Codepeople Appointment Booking Calendar 1.1.4 Codepeople Appointment Booking Calendar 1.1.6 Codepeople Appointment Booking Calendar 1.1.7 Codepeople Appointment Booking Calendar 1.1.8 Codepeople Appointment Booking Calendar 1.1.9 Codepeople Appointment Booking Calendar 1.1.10 Codepeople Appointment Booking Calendar 1.1.11 Codepeople Appointment Booking Calendar 1.1.12 Codepeople Appointment Booking Calendar 1.1.13 Codepeople Appointment Booking Calendar 1.1.14 Codepeople Appointment Booking Calendar 1.1.15 Codepeople Appointment Booking Calendar 1.1.16 Codepeople Appointment Booking Calendar 1.1.17 Codepeople Appointment Booking Calendar 1.1.18 Codepeople Appointment Booking Calendar 1.1.19 Codepeople Appointment Booking Calendar 1.1.20 Codepeople Appointment Booking Calendar 1.1.21 Codepeople Appointment Booking Calendar 1.1.22 Codepeople Appointment Booking Calendar 1.1.23 Codepeople Appointment Booking Calendar 1.1.24 Codepeople Appointment Booking Calendar 1.1.25 Codepeople Appointment Booking Calendar 1.1.26 Codepeople Appointment Booking Calendar 1.1.27 Codepeople Appointment Booking Calendar 1.1.28 Codepeople Appointment Booking Calendar 1.1.29 Codepeople Appointment Booking Calendar 1.1.30 Codepeople Appointment Booking Calendar 1.1.31 Codepeople Appointment Booking Calendar 1.1.32 Codepeople Appointment Booking Calendar 1.1.33 Codepeople Appointment Booking Calendar 1.1.34 Codepeople Appointment Booking Calendar 1.1.35 Codepeople Appointment Booking Calendar 1.1.36 Codepeople Appointment Booking Calendar 1.1.37 Codepeople Appointment Booking Calendar 1.1.38 Codepeople Appointment Booking Calendar 1.1.39 Codepeople Appointment Booking Calendar 1.1.40 Codepeople Appointment Booking Calendar 1.1.41 Codepeople Appointment Booking Calendar 1.1.42 Codepeople Appointment Booking Calendar 1.1.43 Codepeople Appointment Booking Calendar 1.1.44 Codepeople Appointment Booking Calendar 1.1.45 Codepeople Appointment Booking Calendar 1.1.46 Codepeople Appointment Booking Calendar 1.1.47 Codepeople Appointment Booking Calendar 1.1.48 Codepeople Appointment Booking Calendar 1.1.49 Codepeople Appointment Booking Calendar 1.1.50 Codepeople Appointment Booking Calendar 1.1.51 Codepeople Appointment Booking Calendar 1.1.52 Codepeople Appointment Booking Calendar 1.1.53 Codepeople Appointment Booking Calendar 1.1.54 Codepeople Appointment Booking Calendar 1.1.55 Codepeople Appointment Booking Calendar 1.1.56 Codepeople Appointment Booking Calendar 1.1.57 Codepeople Appointment Booking Calendar 1.1.58 Codepeople Appointment Booking Calendar 1.1.59 Codepeople Appointment Booking Calendar 1.1.60 Codepeople Appointment Booking Calendar 1.1.61 Codepeople Appointment Booking Calendar 1.1.62 Codepeople Appointment Booking Calendar 1.1.63 Codepeople Appointment Booking Calendar 1.1.64 Codepeople Appointment Booking Calendar 1.1.65 Codepeople Appointment Booking Calendar 1.1.66 Codepeople Appointment Booking Calendar 1.1.67 Codepeople Appointment Booking Calendar 1.1.68 Codepeople Appointment Booking Calendar 1.1.69 Codepeople Appointment Booking Calendar 1.1.70 Codepeople Appointment Booking Calendar 1.1.71 Codepeople Appointment Booking Calendar 1.1.72 Codepeople Appointment Booking Calendar 1.1.73 Codepeople Appointment Booking Calendar 1.1.74 Codepeople Appointment Booking Calendar 1.1.75 Codepeople Appointment Booking Calendar 1.1.76 Codepeople Appointment Booking Calendar 1.1.77 Codepeople Appointment Booking Calendar 1.1.78 Codepeople Appointment Booking Calendar 1.1.79 Codepeople Appointment Booking Calendar 1.1.80 Codepeople Appointment Booking Calendar 1.1.81 Codepeople Appointment Booking Calendar 1.1.82 Codepeople Appointment Booking Calendar 1.1.83 Codepeople Appointment Booking Calendar 1.1.84 Codepeople Appointment Booking Calendar 1.1.85 Codepeople Appointment Booking Calendar 1.1.86 Codepeople Appointment Booking Calendar 1.1.87 Codepeople Appointment Booking Calendar 1.1.88 Codepeople Appointment Booking Calendar 1.1.89 Codepeople Appointment Booking Calendar 1.1.90 Codepeople Appointment Booking Calendar 1.1.91 Codepeople Appointment Booking Calendar 1.1.92 Codepeople Appointment Booking Calendar 1.1.93 Codepeople Appointment Booking Calendar 1.1.94 Codepeople Appointment Booking Calendar 1.1.95 Codepeople Appointment Booking Calendar 1.1.96 Codepeople Appointment Booking Calendar 1.1.97 Codepeople Appointment Booking Calendar 1.1.98 Codepeople Appointment Booking Calendar 1.1.99 Codepeople Appointment Booking Calendar 1.2.10 Codepeople Appointment Booking Calendar 1.2.11 Codepeople Appointment Booking Calendar 1.2.12 Codepeople Appointment Booking Calendar 1.2.14 Codepeople Appointment Booking Calendar 1.2.15 Codepeople Appointment Booking Calendar 1.2.16 Codepeople Appointment Booking Calendar 1.2.17 Codepeople Appointment Booking Calendar 1.2.18 Codepeople Appointment Booking Calendar 1.2.19 Codepeople Appointment Booking Calendar 1.2.20 Codepeople Appointment Booking Calendar 1.2.21 Codepeople Appointment Booking Calendar 1.2.22 Codepeople Appointment Booking Calendar 1.2.23 Codepeople Appointment Booking Calendar 1.2.24 Codepeople Appointment Booking Calendar 1.2.25 Codepeople Appointment Booking Calendar 1.2.26 Codepeople Appointment Booking Calendar 1.2.27 Codepeople Appointment Booking Calendar 1.2.28 Codepeople Appointment Booking Calendar 1.2.29 Codepeople Appointment Booking Calendar 1.2.30 Codepeople Appointment Booking Calendar 1.2.31 Codepeople Appointment Booking Calendar 1.2.32 Codepeople Appointment Booking Calendar 1.2.33 Codepeople Appointment Booking Calendar 1.2.34 Codepeople Appointment Booking Calendar 1.2.35 Codepeople Appointment Booking Calendar 1.2.36 Codepeople Appointment Booking Calendar 1.2.37 Codepeople Appointment Booking Calendar 1.2.38 Codepeople Appointment Booking Calendar 1.2.39 Codepeople Appointment Booking Calendar 1.2.40 Codepeople Appointment Booking Calendar 1.2.41 Codepeople Appointment Booking Calendar 1.2.42 Codepeople Appointment Booking Calendar 1.2.43 Codepeople Appointment Booking Calendar 1.2.44 Codepeople Appointment Booking Calendar 1.2.45 Codepeople Appointment Booking Calendar 1.2.46 Codepeople Appointment Booking Calendar 1.2.47 Codepeople Appointment Booking Calendar 1.2.48 Codepeople Appointment Booking Calendar 1.2.49 Codepeople Appointment Booking Calendar 1.2.50 Codepeople Appointment Booking Calendar 1.2.51 Codepeople Appointment Booking Calendar 1.2.52 Codepeople Appointment Booking Calendar 1.2.53 Codepeople Appointment Booking Calendar 1.2.54 Codepeople Appointment Booking Calendar 1.2.55 Codepeople Appointment Booking Calendar 1.2.56 Codepeople Appointment Booking Calendar 1.2.57 Codepeople Appointment Booking Calendar 1.2.58 Codepeople Appointment Booking Calendar 1.2.59 Codepeople Appointment Booking Calendar 1.2.60 Codepeople Appointment Booking Calendar 1.2.61 Codepeople Appointment Booking Calendar 1.2.62 Codepeople Appointment Booking Calendar 1.2.63 Codepeople Appointment Booking Calendar 1.2.64 Codepeople Appointment Booking Calendar 1.2.65 Codepeople Appointment Booking Calendar 1.2.66 Codepeople Appointment Booking Calendar 1.2.67 Codepeople Appointment Booking Calendar 1.2.68 Codepeople Appointment Booking Calendar 1.2.69 Codepeople Appointment Booking Calendar 1.2.70 Codepeople Appointment Booking Calendar 1.2.71 Codepeople Appointment Booking Calendar 1.2.72 Codepeople Appointment Booking Calendar 1.2.73 Codepeople Appointment Booking Calendar 1.2.74 Codepeople Appointment Booking Calendar 1.2.75 Codepeople Appointment Booking Calendar 1.2.76 Codepeople Appointment Booking Calendar 1.2.77 Codepeople Appointment Booking Calendar 1.2.78 Codepeople Appointment Booking Calendar 1.2.79 Codepeople Appointment Booking Calendar 1.2.80 Codepeople Appointment Booking Calendar 1.2.81 Codepeople Appointment Booking Calendar 1.2.82 Codepeople Appointment Booking Calendar 1.2.83 Codepeople Appointment Booking Calendar 1.2.84 Codepeople Appointment Booking Calendar 1.2.85 Codepeople Appointment Booking Calendar 1.2.86 Codepeople Appointment Booking Calendar 1.2.87 Codepeople Appointment Booking Calendar 1.2.88 Codepeople Appointment Booking Calendar 1.2.89 Codepeople Appointment Booking Calendar 1.2.90 Codepeople Appointment Booking Calendar 1.2.91 Codepeople Appointment Booking Calendar 1.2.92 Codepeople Appointment Booking Calendar 1.2.93 Codepeople Appointment Booking Calendar 1.2.94 Codepeople Appointment Booking Calendar 1.2.95 Codepeople Appointment Booking Calendar 1.2.96 Codepeople Appointment Booking Calendar 1.2.97 Codepeople Appointment Booking Calendar 1.2.98 Codepeople Appointment Booking Calendar 1.2.99 Codepeople Appointment Booking Calendar 1.3.01 Codepeople Appointment Booking Calendar 1.3.02 Codepeople Appointment Booking Calendar 1.3.03 Codepeople Appointment Booking Calendar 1.3.04 Codepeople Appointment Booking Calendar 1.3.05 Codepeople Appointment Booking Calendar 1.3.06 Codepeople Appointment Booking Calendar 1.3.07 Codepeople Appointment Booking Calendar 1.3.08 Codepeople Appointment Booking Calendar 1.3.09 Codepeople Appointment Booking Calendar 1.3.10 Codepeople Appointment Booking Calendar 1.3.11 Codepeople Appointment Booking Calendar 1.3.12 Codepeople Appointment Booking Calendar 1.3.13 Codepeople Appointment Booking Calendar 1.3.14 Codepeople Appointment Booking Calendar 1.3.15 Codepeople Appointment Booking Calendar 1.3.16 Codepeople Appointment Booking Calendar 1.3.17 Codepeople Appointment Booking Calendar 1.3.18 Codepeople Appointment Booking Calendar 1.3.19 Codepeople Appointment Booking Calendar 1.3.20 Codepeople Appointment Booking Calendar 1.3.21 Codepeople Appointment Booking Calendar 1.3.22 Codepeople Appointment Booking Calendar 1.3.23 Codepeople Appointment Booking Calendar 1.3.24 Codepeople Appointment Booking Calendar 1.3.25	211

Common Weakness Enumeration (CWE)

CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

Packetstorm

data source	https://packetstormsecurity.com/files/download/156694/wpbookingcalendar1334-csvinject.txt
id	PACKETSTORM:156694
last seen	2020-03-13
published	2020-03-12
reporter	Daniel Monzon
source	https://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html
title	WordPress Appointment Booking Calendar 1.3.34 CSV Injection

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Packetstorm

References