Description
MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of view_entry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete bookings, or perform administrative actions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| meeting-room-booking-system | mrbs-code | < 1.12.3 | 1.12.3 |
References
- GitHub Security Advisory (GHSA-5wqw-q7gh-j65v) vendor-advisory
- https://github.com/meeting-room-booking-system/mrbs-code/commit/83b8253853359964f850208c28036b2bfa202466 patch
- mrbs-code v1.12.3 Release Notes release-notes
- https://github.com/meeting-room-booking-system/mrbs-code/blob/38d51e05f4a0ab39820f3830ca5dcae5f34d8546/web/view_entry.php#L966-L969 technical-description
- VulnCheck Advisory: MRBS before 1.12.3 Reflected XSS via error parameter of view_entry.php third-party-advisory