Description
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Salon Booking System | < 10.31.11 | 10.31.11 |
References
- https://wpscan.com/vulnerability/e3a64d4d-92db-4dbc-a0b5-58bca4d8b5c4/ exploit vdb-entry technical-description