Appointment Booking Calendar Plugin up to 1.3.34 on WordPress admin.php?page=cpabc_appointments.php injection

Summaryinfo

A vulnerability was found in Appointment Booking Calendar Plugin up to 1.3.34 on WordPress and classified as critical. The affected element is an unknown function of the file /wp-admin/admin.php?page=cpabc_appointments.php. The manipulation results in injection. This vulnerability is reported as CVE-2020-9372. The attack requires a local approach. Moreover, an exploit is present. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Appointment Booking Calendar Plugin up to 1.3.34 on WordPress (Appointment Software). It has been classified as critical. Affected is an unknown code of the file /wp-admin/admin.php?page=cpabc_appointments.php. The manipulation with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.

The weakness was disclosed 03/04/2020. This vulnerability is traded as CVE-2020-9372 since 02/24/2020. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details and a public exploit are known. This vulnerability is assigned to T1055 by the MITRE ATT&CK project.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:wp-admin/admin.php?page=cpabc_appointments.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.3.35 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (48204). The entry VDB-150881 is pretty similar. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Appointment Software

Name

• Appointment Booking Calendar Plugin

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6
• 1.3.7
• 1.3.8
• 1.3.9
• 1.3.10
• 1.3.11
• 1.3.12
• 1.3.13
• 1.3.14
• 1.3.15
• 1.3.16
• 1.3.17
• 1.3.18
• 1.3.19
• 1.3.20
• 1.3.21
• 1.3.22
• 1.3.23
• 1.3.24
• 1.3.25
• 1.3.26
• 1.3.27
• 1.3.28
• 1.3.29
• 1.3.30
• 1.3.31
• 1.3.32
• 1.3.33
• 1.3.34

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion