CVE-2022-30706

The CVE-2022-30706 issue affects Booked versions prior to 3.3. Open redirect is possible when a specially crafted URL is accessed, enabling a remote unauthenticated attacker to redirect a user to an arbitrary site and potentially facilitate phishing. The root cause involves how user-supplied data...

Booked vulnerable to open redirect

Overview Booked provided by Twinkle Toes Software contains an open redirect vulnerability CWE-601. Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact When...

Twinkle Toes Software Booked 输入验证错误漏洞

Twinkle Toes Software Booked is a simple yet powerful appointment scheduling solution from Twinkle Toes Software, USA. An input validation error vulnerability exists in versions of Twinkle Toes Software Booked prior to 3.3, which stems from its mishandling of user-supplied data resulting in...

Cross-site Scripting (XSS) - Reflected in effgarces/bookedscheduler

Setup the Booked Scheduler locally.URL like the following. http://192.168.5.5/phpsch/ Attcker 2. Login as valid user. 3. Make an reservation from the dashboard. 4. Open the information you reserved.URL like the following http://192.168.5.5/Web/reservation.php?rn=62020af2eee4d833634703 5. The...

Booked Scheduler 2.7.5 - Remote Command Execution Exploit

Exploit Title: Booked Scheduler 2.7.5 - Remote Command Execution RCE Authenticated Vulnerability founder: AkkuS Exploit Author: 0sunday Vendor Homepage: https://www.bookedscheduler.com/ Software Link: N/A Version: Booked Scheduler 2.7.5 Tester on: Kali 2021.2 CVE: CVE-2019-9581 !/usr/bin/python3...

Booked Scheduler 2.7.5 Shell Upload

Exploit Title: Booked Scheduler 2.7.5 - Remote Command Execution RCE Authenticated Vulnerability founder: AkkuS Date: 13/12/2021 Exploit Author: 0sunday Vendor Homepage: https://www.bookedscheduler.com/ Software Link: N/A Version: Booked Scheduler 2.7.5 Tester on: Kali 2021.2 CVE: CVE-2019-9581...

Booked Scheduler 2.7.7 - Authenticated Directory Traversal Vulnerability

Exploit for php platform in category web applications Exploit Title: Booked Scheduler 2.7.7 - Authenticated Directory Traversal Author: Besim ALTINOK Vendor Homepage: https://www.bookedscheduler.com Software Link: https://sourceforge.net/projects/phpscheduleit/ Version: v2.7.7 Tested on: Xampp...

Booked Scheduler 2.7.7 Directory Traversal

Exploit Title: Booked Scheduler 2.7.7 - Authenticated Directory Traversal Date: 2020-05-03 Author: Besim ALTINOK Vendor Homepage: https://www.bookedscheduler.com Software Link: https://sourceforge.net/projects/phpscheduleit/ Version: v2.7.7 Tested on: Xampp Credit: İsmail BOZKURT Description:...

Booked Scheduler 2.7.7 - Authenticated Directory Traversal

Exploit Title: Booked Scheduler 2.7.7 - Authenticated Directory Traversal Date: 2020-05-03 Author: Besim ALTINOK Vendor Homepage: https://www.bookedscheduler.com Software Link: https://sourceforge.net/projects/phpscheduleit/ Version: v2.7.7 Tested on: Xampp Credit: İsmail BOZKURT Description:...

WordPress Booked premium plugin <= 2.2.5 - Broken Authentication vulnerability leading to Sensitive Information disclosure

Broken Authentication vulnerability leading to Sensitive Information disclosure discovered by Noman Riffat in WordPress Booked premium plugin versions = 2.2.5. Solution Update the WordPress Booked premium plugin to the latest available version at least 2.2.6...

CVE-2019-9581

phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension...

CVE-2019-9581

phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension...

Default credentials

phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension...

Booked Scheduler 2.7.5 - Remote Command Execution Exploit

Exploit for php platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Booked Scheduler v2.7.5 - Remote Command Execution', 'Description' = %q This module exploits...