CVE Feed

    Dashboard / CVE / CVE-2023-24058

    CVE-2023-24058

    Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affected. However, LabArchives Scheduler (Sep 6, 2022 Feature Release) is affected.

    Published:Jan 22, 2023
    Last Modified:Apr 2, 2025
    EPS:Jan 22, 2023
    EPSS Score:0.00119
    CVSS Score:4.3

    Affected Products

    Vendor
    Twinkletoessoftware
    Product
    Booked

    Exploits

    https://github.com/LibreBooking/app/blob/0a6cb1a9eb84835553c8caf93db2791f8655140f/Pages/Ajax/ReservationSavePage.php#L234-L237https://github.com/LibreBooking/app/blob/0a6cb1a9eb84835553c8caf93db2791f8655140f/Web/ajax/reservation_save.phphttps://s1n1st3r.gitbook.io/theb10g/booked-scheduler-v2.5.5-vulnerabilityhttps://github.com/LibreBooking/app/blob/0a6cb1a9eb84835553c8caf93db2791f8655140f/Pages/Ajax/ReservationSavePage.php#L234-L237https://github.com/LibreBooking/app/blob/0a6cb1a9eb84835553c8caf93db2791f8655140f/Web/ajax/reservation_save.phphttps://s1n1st3r.gitbook.io/theb10g/booked-scheduler-v2.5.5-vulnerability

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    References

    https://github.com/LibreBooking/app/blob/0a6cb1a9eb84835553c8caf93db2791f8655140f/Pages/Ajax/ReservationSavePage.php#L234-L237
    https://github.com/LibreBooking/app/blob/0a6cb1a9eb84835553c8caf93db2791f8655140f/Web/ajax/reservation_save.php
    https://github.com/LibreBooking/app/tags?after=2.7.1
    https://s1n1st3r.gitbook.io/theb10g/booked-scheduler-v2.5.5-vulnerability
    https://www.bookedscheduler.com/the-future-of-booked/
    https://www.labarchives.com/labarchives-knowledge-base/2022-feature-releases-2/
    https://www.limswiki.org/index.php/Booked
    https://github.com/LibreBooking/app/blob/0a6cb1a9eb84835553c8caf93db2791f8655140f/Pages/Ajax/ReservationSavePage.php#L234-L237
    https://github.com/LibreBooking/app/blob/0a6cb1a9eb84835553c8caf93db2791f8655140f/Web/ajax/reservation_save.php
    https://github.com/LibreBooking/app/tags?after=2.7.1
    https://s1n1st3r.gitbook.io/theb10g/booked-scheduler-v2.5.5-vulnerability
    https://www.bookedscheduler.com/the-future-of-booked/
    https://www.labarchives.com/labarchives-knowledge-base/2022-feature-releases-2/
    https://www.limswiki.org/index.php/Booked

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High