Vulnerabilities > CVE-2023-5527 - Improper Neutralization of Formula Elements in a CSV File vulnerability in Businessdirectoryplugin Business Directory

CVSS 8.0 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

businessdirectoryplugin

CWE-1236

NVD

Published: 2024-06-18

Updated: 2024-07-05

Summary

The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-exporter.php file. This allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported by administrators, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Vulnerable Configurations

Part	Description	Count
Application	Businessdirectoryplugin Businessdirectoryplugin Business Directory - Businessdirectoryplugin Business Directory 6.3 Businessdirectoryplugin Business Directory 6.3.1 Businessdirectoryplugin Business Directory 6.3.2 Businessdirectoryplugin Business Directory 6.3.3 Businessdirectoryplugin Business Directory 6.3.4 Businessdirectoryplugin Business Directory 6.3.5 Businessdirectoryplugin Business Directory 6.3.6 Businessdirectoryplugin Business Directory 6.3.7 Businessdirectoryplugin Business Directory 6.3.8 Businessdirectoryplugin Business Directory 6.3.10 Businessdirectoryplugin Business Directory 6.3.11 Businessdirectoryplugin Business Directory 6.4 Businessdirectoryplugin Business Directory 6.4.1 Businessdirectoryplugin Business Directory 6.4.2 Businessdirectoryplugin Business Directory 6.4.3	16

Common Weakness Enumeration (CWE)

CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References