CVE-2022-4034 Appointment Hour Booking <= 1.3.72 - CSV Injection

What is CVE-2022-4034?

CVE-2022-4034 is a medium-severity code injection vulnerability in codepeople Appointment Hour Booking – Booking Calendar, published on 29 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's administrator exports booking details. This can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Weakness: CWE-1236

Which versions are affected by CVE-2022-4034?

It affects 1 product.

Products include Dwbooster Appointment Hour Booking.

How do I fix CVE-2022-4034?

No fix has been published for CVE-2022-4034 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-4034 being exploited?

There is no known exploitation of CVE-2022-4034 in the wild and no public exploit code.

Other vulnerabilities in codepeople Appointment Hour Booking – Booking Calendar

• CVE-2022-4035 Appointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment Form High 7.2
• CVE-2019-13505 Cross-site scripting in n/a Medium 6.1
• CVE-2021-24712 Appointment Hour Booking – WordPress Booking Plugin < 1.3.17 - Authenticated Stored XSS Medium 5.4
• CVE-2022-4036 Appointment Hour Booking <= 1.3.72 - CAPTCHA Bypass Medium 5.3
• CVE-2022-1710 Appointment Hour Booking < 1.3.56 - Admin+ Stored Cross-Site Scripting Medium 4.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-35hg-hj3j-7whc.