CVE-2023-51336
Phpjabbers Meeting Room Booking System 1.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-51336 is a high-severity Improper Neutralization of Formula Elements in a CSV File (CWE-1236) vulnerability in Phpjabbers Meeting Room Booking System. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique LSASS Memory (T1003.001); ranked at the 50th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-15 (Information Output Filtering) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-51336 is a CSV injection vulnerability in PHPJabbers Meeting Room Booking System v1.0. The flaw arises from insufficient input validation in the Languages section's Labels any parameters field within System Options, where user-supplied data is used to construct CSV files without proper sanitization. This allows injection of malicious payloads, such as formulas, leading to remote code execution. The vulnerability is associated with CWE-1236 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An authenticated attacker with low privileges can exploit this issue remotely over the network with low complexity and no user interaction required. By injecting crafted input into the affected field, the attacker can embed executable code in the resulting CSV file, which executes when opened in applications like spreadsheet software, achieving remote code execution with high impacts on confidentiality, integrity, and availability.
Advisories detailing the vulnerability, including a proof-of-concept, are available via PacketStormsecurity references such as https://packetstorm.news/files/id/176518 and http://packetstormsecurity.com/files/176518/PHPJabbers-Meeting-Room-Booking-System-1.0-CSV-Injection.html. The vendor's demo page at https://www.phpjabbers.com/meeting-room-booking-system/#sectionDemo provides additional context on the affected software, though no specific patches or mitigations are detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-56057
Vulnerability Data
PHPJabbers Meeting Room Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is…
more
used to construct CSV file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.10
Mitigating Controls (NIST 800-53 r5) AI
Output filtering/validation directly stops unneutralized formula elements from being written into CSV files.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require output neutralization for untrusted CSV content to block formula injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.