Description
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain management hashes for rescheduling or cancellation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
alextselegidis easyappointments
Default version status: unaffected
0 to ≤ 1.6.0affected
pkg:github/alextselegidis/easyappointmentsReferences
- https://hackmd.io/@haind/easyappointments-booking-register-appointment-takeover ↗
- https://github.com/alextselegidis/easyappointments/blob/4bc7ecd51f3dade8e041558f2c23dda65bd6c43e/application/controllers/Booking.php#L368-L587 ↗
- https://github.com/alextselegidis/easyappointments/commit/09c6fb30b6aac0830a820d6bec3d2eb241daf150 ↗
- https://github.com/alextselegidis/easyappointments ↗
- https://www.vulncheck.com/advisories/easy-appointments-through-1.6.0-authorization-bypass-via-booking-register-endpoint ↗