CVE-2023-24058

Vulnerability

Booked Scheduler version 2.5.5 (a 2014 release) contains an insecure direct object reference (IDOR) vulnerability in the reservation_save.php endpoint. An authenticated user can supply an arbitrary userId value in the POST parameters to create or schedule events on behalf of any other user in the system. The endpoint does not verify that the requesting user has permission to act on behalf of the specified userId. This affects the open-source version 2.5.5; the latest version of Booked Scheduler is not vulnerable. However, LabArchives Scheduler (September 6, 2022 Feature Release) is also affected as it is based on the same vulnerable code base [1][3].

Exploitation

An attacker must have a valid authenticated session in Booked Scheduler 2.5.5. No additional privileges are required beyond standard user access. The attacker crafts a request to reservation_save.php that includes a modified userId parameter (e.g., a different user's ID) along with event details. The server accepts this request without checking whether the authenticated user is authorized to create reservations for the targeted user. The attacker can repeat this for any user ID, including administrative accounts [2].

Impact

A successful attack allows the authenticated attacker to create, modify, or schedule events for any other user in the system. This can lead to impersonation, scheduling conflicts, or unauthorized resource reservations. The attacker gains the ability to manipulate the calendar of any user, potentially causing denial of service or data integrity issues. There is no privilege escalation toward administrative functions beyond the scope of reservation creation, but the attacker can disrupt the scheduling operations of other users [2][3].

Mitigation

No official patch is available for the open-source version 2.5.5 because that release is from 2014 and the open-source project has been discontinued (last open-source release is 2.8.5 from November 1, 2020; no further open-source updates are provided) [1][2]. Users still running 2.5.5 should upgrade to a supported version (hosted or licensed), or migrate to a newer fork such as LibreBooking, which may have addressed the issue. For LabArchives Scheduler, contact the vendor for an update. There is no known workaround documented in the public references. The CVE has not been added to CISA's Known Exploited Vulnerabilities catalog [3][4].