Vulnerabilities > CVE-2020-9372 - Improper Neutralization of Formula Elements in a CSV File vulnerability in Codepeople Appointment Booking Calendar

CVSS 6.8 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

codepeople

CWE-1236

NVD

Published: 2020-03-04

Updated: 2022-01-01

Summary

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.

Vulnerable Configurations

Part	Description	Count
Application	Codepeople Codepeople Appointment Booking Calendar 1.0.1 Codepeople Appointment Booking Calendar 1.1.3 Codepeople Appointment Booking Calendar 1.1.4 Codepeople Appointment Booking Calendar 1.1.6 Codepeople Appointment Booking Calendar 1.1.7 Codepeople Appointment Booking Calendar 1.1.8 Codepeople Appointment Booking Calendar 1.1.9 Codepeople Appointment Booking Calendar 1.1.10 Codepeople Appointment Booking Calendar 1.1.11 Codepeople Appointment Booking Calendar 1.1.12 Codepeople Appointment Booking Calendar 1.1.13 Codepeople Appointment Booking Calendar 1.1.14 Codepeople Appointment Booking Calendar 1.1.15 Codepeople Appointment Booking Calendar 1.1.16 Codepeople Appointment Booking Calendar 1.1.17 Codepeople Appointment Booking Calendar 1.1.18 Codepeople Appointment Booking Calendar 1.1.19 Codepeople Appointment Booking Calendar 1.1.20 Codepeople Appointment Booking Calendar 1.1.21 Codepeople Appointment Booking Calendar 1.1.22 Codepeople Appointment Booking Calendar 1.1.23 Codepeople Appointment Booking Calendar 1.1.24 Codepeople Appointment Booking Calendar 1.1.25 Codepeople Appointment Booking Calendar 1.1.26 Codepeople Appointment Booking Calendar 1.1.27 Codepeople Appointment Booking Calendar 1.1.28 Codepeople Appointment Booking Calendar 1.1.29 Codepeople Appointment Booking Calendar 1.1.30 Codepeople Appointment Booking Calendar 1.1.31 Codepeople Appointment Booking Calendar 1.1.32 Codepeople Appointment Booking Calendar 1.1.33 Codepeople Appointment Booking Calendar 1.1.34 Codepeople Appointment Booking Calendar 1.1.35 Codepeople Appointment Booking Calendar 1.1.36 Codepeople Appointment Booking Calendar 1.1.37 Codepeople Appointment Booking Calendar 1.1.38 Codepeople Appointment Booking Calendar 1.1.39 Codepeople Appointment Booking Calendar 1.1.40 Codepeople Appointment Booking Calendar 1.1.41 Codepeople Appointment Booking Calendar 1.1.42 Codepeople Appointment Booking Calendar 1.1.43 Codepeople Appointment Booking Calendar 1.1.44 Codepeople Appointment Booking Calendar 1.1.45 Codepeople Appointment Booking Calendar 1.1.46 Codepeople Appointment Booking Calendar 1.1.47 Codepeople Appointment Booking Calendar 1.1.48 Codepeople Appointment Booking Calendar 1.1.49 Codepeople Appointment Booking Calendar 1.1.50 Codepeople Appointment Booking Calendar 1.1.51 Codepeople Appointment Booking Calendar 1.1.52 Codepeople Appointment Booking Calendar 1.1.53 Codepeople Appointment Booking Calendar 1.1.54 Codepeople Appointment Booking Calendar 1.1.55 Codepeople Appointment Booking Calendar 1.1.56 Codepeople Appointment Booking Calendar 1.1.57 Codepeople Appointment Booking Calendar 1.1.58 Codepeople Appointment Booking Calendar 1.1.59 Codepeople Appointment Booking Calendar 1.1.60 Codepeople Appointment Booking Calendar 1.1.61 Codepeople Appointment Booking Calendar 1.1.62 Codepeople Appointment Booking Calendar 1.1.63 Codepeople Appointment Booking Calendar 1.1.64 Codepeople Appointment Booking Calendar 1.1.65 Codepeople Appointment Booking Calendar 1.1.66 Codepeople Appointment Booking Calendar 1.1.67 Codepeople Appointment Booking Calendar 1.1.68 Codepeople Appointment Booking Calendar 1.1.69 Codepeople Appointment Booking Calendar 1.1.70 Codepeople Appointment Booking Calendar 1.1.71 Codepeople Appointment Booking Calendar 1.1.72 Codepeople Appointment Booking Calendar 1.1.73 Codepeople Appointment Booking Calendar 1.1.74 Codepeople Appointment Booking Calendar 1.1.75 Codepeople Appointment Booking Calendar 1.1.76 Codepeople Appointment Booking Calendar 1.1.77 Codepeople Appointment Booking Calendar 1.1.78 Codepeople Appointment Booking Calendar 1.1.79 Codepeople Appointment Booking Calendar 1.1.80 Codepeople Appointment Booking Calendar 1.1.81 Codepeople Appointment Booking Calendar 1.1.82 Codepeople Appointment Booking Calendar 1.1.83 Codepeople Appointment Booking Calendar 1.1.84 Codepeople Appointment Booking Calendar 1.1.85 Codepeople Appointment Booking Calendar 1.1.86 Codepeople Appointment Booking Calendar 1.1.87 Codepeople Appointment Booking Calendar 1.1.88 Codepeople Appointment Booking Calendar 1.1.89 Codepeople Appointment Booking Calendar 1.1.90 Codepeople Appointment Booking Calendar 1.1.91 Codepeople Appointment Booking Calendar 1.1.92 Codepeople Appointment Booking Calendar 1.1.93 Codepeople Appointment Booking Calendar 1.1.94 Codepeople Appointment Booking Calendar 1.1.95 Codepeople Appointment Booking Calendar 1.1.96 Codepeople Appointment Booking Calendar 1.1.97 Codepeople Appointment Booking Calendar 1.1.98 Codepeople Appointment Booking Calendar 1.1.99 Codepeople Appointment Booking Calendar 1.2.10 Codepeople Appointment Booking Calendar 1.2.11 Codepeople Appointment Booking Calendar 1.2.12 Codepeople Appointment Booking Calendar 1.2.14 Codepeople Appointment Booking Calendar 1.2.15 Codepeople Appointment Booking Calendar 1.2.16 Codepeople Appointment Booking Calendar 1.2.17 Codepeople Appointment Booking Calendar 1.2.18 Codepeople Appointment Booking Calendar 1.2.19 Codepeople Appointment Booking Calendar 1.2.20 Codepeople Appointment Booking Calendar 1.2.21 Codepeople Appointment Booking Calendar 1.2.22 Codepeople Appointment Booking Calendar 1.2.23 Codepeople Appointment Booking Calendar 1.2.24 Codepeople Appointment Booking Calendar 1.2.25 Codepeople Appointment Booking Calendar 1.2.26 Codepeople Appointment Booking Calendar 1.2.27 Codepeople Appointment Booking Calendar 1.2.28 Codepeople Appointment Booking Calendar 1.2.29 Codepeople Appointment Booking Calendar 1.2.30 Codepeople Appointment Booking Calendar 1.2.31 Codepeople Appointment Booking Calendar 1.2.32 Codepeople Appointment Booking Calendar 1.2.33 Codepeople Appointment Booking Calendar 1.2.34 Codepeople Appointment Booking Calendar 1.2.35 Codepeople Appointment Booking Calendar 1.2.36 Codepeople Appointment Booking Calendar 1.2.37 Codepeople Appointment Booking Calendar 1.2.38 Codepeople Appointment Booking Calendar 1.2.39 Codepeople Appointment Booking Calendar 1.2.40 Codepeople Appointment Booking Calendar 1.2.41 Codepeople Appointment Booking Calendar 1.2.42 Codepeople Appointment Booking Calendar 1.2.43 Codepeople Appointment Booking Calendar 1.2.44 Codepeople Appointment Booking Calendar 1.2.45 Codepeople Appointment Booking Calendar 1.2.46 Codepeople Appointment Booking Calendar 1.2.47 Codepeople Appointment Booking Calendar 1.2.48 Codepeople Appointment Booking Calendar 1.2.49 Codepeople Appointment Booking Calendar 1.2.50 Codepeople Appointment Booking Calendar 1.2.51 Codepeople Appointment Booking Calendar 1.2.52 Codepeople Appointment Booking Calendar 1.2.53 Codepeople Appointment Booking Calendar 1.2.54 Codepeople Appointment Booking Calendar 1.2.55 Codepeople Appointment Booking Calendar 1.2.56 Codepeople Appointment Booking Calendar 1.2.57 Codepeople Appointment Booking Calendar 1.2.58 Codepeople Appointment Booking Calendar 1.2.59 Codepeople Appointment Booking Calendar 1.2.60 Codepeople Appointment Booking Calendar 1.2.61 Codepeople Appointment Booking Calendar 1.2.62 Codepeople Appointment Booking Calendar 1.2.63 Codepeople Appointment Booking Calendar 1.2.64 Codepeople Appointment Booking Calendar 1.2.65 Codepeople Appointment Booking Calendar 1.2.66 Codepeople Appointment Booking Calendar 1.2.67 Codepeople Appointment Booking Calendar 1.2.68 Codepeople Appointment Booking Calendar 1.2.69 Codepeople Appointment Booking Calendar 1.2.70 Codepeople Appointment Booking Calendar 1.2.71 Codepeople Appointment Booking Calendar 1.2.72 Codepeople Appointment Booking Calendar 1.2.73 Codepeople Appointment Booking Calendar 1.2.74 Codepeople Appointment Booking Calendar 1.2.75 Codepeople Appointment Booking Calendar 1.2.76 Codepeople Appointment Booking Calendar 1.2.77 Codepeople Appointment Booking Calendar 1.2.78 Codepeople Appointment Booking Calendar 1.2.79 Codepeople Appointment Booking Calendar 1.2.80 Codepeople Appointment Booking Calendar 1.2.81 Codepeople Appointment Booking Calendar 1.2.82 Codepeople Appointment Booking Calendar 1.2.83 Codepeople Appointment Booking Calendar 1.2.84 Codepeople Appointment Booking Calendar 1.2.85 Codepeople Appointment Booking Calendar 1.2.86 Codepeople Appointment Booking Calendar 1.2.87 Codepeople Appointment Booking Calendar 1.2.88 Codepeople Appointment Booking Calendar 1.2.89 Codepeople Appointment Booking Calendar 1.2.90 Codepeople Appointment Booking Calendar 1.2.91 Codepeople Appointment Booking Calendar 1.2.92 Codepeople Appointment Booking Calendar 1.2.93 Codepeople Appointment Booking Calendar 1.2.94 Codepeople Appointment Booking Calendar 1.2.95 Codepeople Appointment Booking Calendar 1.2.96 Codepeople Appointment Booking Calendar 1.2.97 Codepeople Appointment Booking Calendar 1.2.98 Codepeople Appointment Booking Calendar 1.2.99 Codepeople Appointment Booking Calendar 1.3.01 Codepeople Appointment Booking Calendar 1.3.02 Codepeople Appointment Booking Calendar 1.3.03 Codepeople Appointment Booking Calendar 1.3.04 Codepeople Appointment Booking Calendar 1.3.05 Codepeople Appointment Booking Calendar 1.3.06 Codepeople Appointment Booking Calendar 1.3.07 Codepeople Appointment Booking Calendar 1.3.08 Codepeople Appointment Booking Calendar 1.3.09 Codepeople Appointment Booking Calendar 1.3.10 Codepeople Appointment Booking Calendar 1.3.11 Codepeople Appointment Booking Calendar 1.3.12 Codepeople Appointment Booking Calendar 1.3.13 Codepeople Appointment Booking Calendar 1.3.14 Codepeople Appointment Booking Calendar 1.3.15 Codepeople Appointment Booking Calendar 1.3.16 Codepeople Appointment Booking Calendar 1.3.17 Codepeople Appointment Booking Calendar 1.3.18 Codepeople Appointment Booking Calendar 1.3.19 Codepeople Appointment Booking Calendar 1.3.20 Codepeople Appointment Booking Calendar 1.3.21 Codepeople Appointment Booking Calendar 1.3.22 Codepeople Appointment Booking Calendar 1.3.23 Codepeople Appointment Booking Calendar 1.3.24 Codepeople Appointment Booking Calendar 1.3.25	211

Common Weakness Enumeration (CWE)

CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

Packetstorm

data source	https://packetstormsecurity.com/files/download/156694/wpbookingcalendar1334-csvinject.txt
id	PACKETSTORM:156694
last seen	2020-03-13
published	2020-03-12
reporter	Daniel Monzon
source	https://packetstormsecurity.com/files/156694/WordPress-Appointment-Booking-Calendar-1.3.34-CSV-Injection.html
title	WordPress Appointment Booking Calendar 1.3.34 CSV Injection

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Packetstorm

References