Insecure Direct Object Reference in LatePoint Booking Steps

The booking step loader fetched an existing booking by id without checking it belongs to the requesting customer, letting a visitor read or alter someone else's booking. The fix verifies ownership and refuses otherwise. Fixed in 5.2.7. This vulnerability affects the following application versions: LatePoint 5.1.0 LatePoint 5.1.1 LatePoint 5.1.2... Weiterlesen: Insecure Direct Object Reference in LatePoint Booking Steps