Easy!Appointments Booking Logic Flaw Leading to Denial-of-Service

A booking logic vulnerability has been identified in Easy!Appointments version 1.5.1. This flaw allows unauthenticated attackers to create appointments with excessively long durations. As a result, the vulnerability disrupts normal scheduling by blocking all future booking availability, effectively causing a denial-of-service condition.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition by blocking future booking availability.

Reproduction

To reproduce this vulnerability, intercept an appointment booking request and locate the 'post_data[appointment][end_datetime]' parameter in the request body. Modify this parameter to a date far in the future and send the request. The application will accept the long booking, which blocks all future availability.

Remediation

Users can update to Easy!Appointments version 1.6.0 or later, where this vulnerability has been addressed.