CVE-2024-49304 in Pinpoint Booking System Plugin
Summary
by MITRE • 10/17/2024
Cross-Site Request Forgery (CSRF) vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Stored XSS.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.5.7.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/06/2026
The CVE-2024-49304 vulnerability represents a critical security flaw in the DOTonPAPER Pinpoint Booking System that combines cross-site request forgery with stored cross-site scripting capabilities. This vulnerability exists within the booking-system component of the Pinpoint Booking System and affects versions ranging from the initial release through version 2.9.9.5.7. The flaw stems from insufficient validation and sanitization of user-supplied input within the system's booking functionality, creating a pathway for malicious actors to execute persistent XSS attacks through CSRF vectors. The vulnerability's classification as a stored XSS issue indicates that malicious payloads can be permanently stored within the application's database or server-side resources, making them persistently executable whenever affected pages are accessed by unsuspecting users.
The technical implementation of this vulnerability involves the exploitation of CSRF mechanisms that fail to properly validate the origin of requests or implement adequate anti-CSRF tokens. When legitimate users interact with the booking system, malicious actors can craft specially crafted requests that, when executed, store malicious JavaScript payloads within the system's data storage. These payloads become active when other users view booking information or interact with the affected system components, leading to unauthorized code execution within the victim's browser context. The vulnerability's impact extends beyond simple data theft as it can enable session hijacking, credential theft, and the potential for privilege escalation within the affected system environment.
From an operational standpoint, this vulnerability poses significant risks to organizations utilizing the Pinpoint Booking System for managing reservations and customer bookings. The stored nature of the XSS payload means that once exploited, the malicious code can affect multiple users over extended periods without requiring repeated exploitation attempts. Attackers can leverage this vulnerability to inject malicious scripts that redirect users to phishing sites, steal session cookies, or manipulate booking data. The combination of CSRF and XSS creates a particularly dangerous attack vector as it allows attackers to bypass traditional CSRF protection mechanisms while simultaneously executing persistent malicious code. This dual nature of the vulnerability increases the attack surface and makes detection more challenging for security teams monitoring the system.
Organizations should prioritize immediate remediation of this vulnerability by upgrading to versions beyond 2.9.9.5.7 where the issue has been addressed. The mitigation strategy should include implementing robust input validation and output encoding mechanisms, deploying comprehensive CSRF protection tokens, and ensuring proper sanitization of all user-supplied data before storage. Security measures should also incorporate regular security testing including automated scanning and manual penetration testing to identify similar vulnerabilities within the application's codebase. The vulnerability aligns with CWE-352, which specifically addresses Cross-Site Request Forgery, and CWE-79, which covers Cross-Site Scripting, making it a compound vulnerability that requires attention to both aspects of web application security. From an ATT&CK framework perspective, this vulnerability maps to T1566 for initial access through web application attacks and T1059 for command and control through script injection techniques, highlighting the multi-stage nature of potential exploitation.