CVE-2023-24058

Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affected. However, LabArchives Scheduler (Sep 6, 2022 Feature Release) is affected.

• CWE-284

• https://github.com/LibreBooking/app/blob/0a6cb1a9eb84835553c8caf93db2791f8655140f/Pages/Ajax/ReservationSavePage.php#L234-L237Exploit, Third Party Advisory
• https://github.com/LibreBooking/app/blob/0a6cb1a9eb84835553c8caf93db2791f8655140f/Web/ajax/reservation_save.phpExploit, Third Party Advisory
• https://github.com/LibreBooking/app/tags?after=2.7.1Third Party Advisory
• https://s1n1st3r.gitbook.io/theb10g/booked-scheduler-v2.5.5-vulnerabilityExploit, Third Party Advisory
• https://www.bookedscheduler.com/the-future-of-booked/Vendor Advisory
• https://www.labarchives.com/labarchives-knowledge-base/2022-feature-releases-2/Release Notes, Vendor Advisory
• https://www.limswiki.org/index.php/BookedThird Party Advisory
• https://github.com/LibreBooking/app/blob/0a6cb1a9eb84835553c8caf93db2791f8655140f/Pages/Ajax/ReservationSavePage.php#L234-L237Exploit, Third Party Advisory
• https://github.com/LibreBooking/app/blob/0a6cb1a9eb84835553c8caf93db2791f8655140f/Web/ajax/reservation_save.phpExploit, Third Party Advisory
• https://github.com/LibreBooking/app/tags?after=2.7.1Third Party Advisory
• https://s1n1st3r.gitbook.io/theb10g/booked-scheduler-v2.5.5-vulnerabilityExploit, Third Party Advisory
• https://www.bookedscheduler.com/the-future-of-booked/Vendor Advisory
• https://www.labarchives.com/labarchives-knowledge-base/2022-feature-releases-2/Release Notes, Vendor Advisory
• https://www.limswiki.org/index.php/BookedThird Party Advisory

Published

Jan 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24051A client side rate limit issue discovered in Connectize AC21…9.8
• CVE-2023-24052An issue discovered in Connectize AC21000 G6 641.139.1.1256 …9.8
• CVE-2023-24054Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-24055KeePass through 2.53 (in a default installation) allows an a…5.5
• CVE-2023-24056In pkgconf through 1.9.3, variable duplication can cause unb…5.5
• CVE-2023-24057HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow…8.1
• CVE-2023-24059Grand Theft Auto V for PC allows attackers to achieve partia…7.3
• CVE-2023-2406The Event Registration Calendar By vcita plugin, versions up…5.4
• CVE-2023-24060Haven 5d15944 allows Server-Side Request Forgery (SSRF) via …5
• CVE-2023-24062Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-24063Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-24064Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8