CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.5.7.
Explanation of Vulnerability in Simple Terms
The Pinpoint Booking System contains an authorization flaw that allows authenticated users to access, modify, or disrupt data they should not have permission to view or change. An attacker with a low-privilege account can read sensitive information, alter bookings or settings, or cause service disruptions. This affects all versions up to 2.9.9.5.7. Update to a version newer than the affected range.
What an attacker can do
Read, modify, or delete data belonging to other users or the system without proper authorization.
Potential impact on your site
Booking data, customer information, and system settings are exposed to unauthorized access and modification by any logged-in user.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the booking system.
Key dates
External resources
Related vulnerabilities
