Karan J

**Name of the Vulnerable Software and Affected Versions** TrueBooker – Appointment Booking and Scheduler System versions prior to 1.2.3 **Description** An issue exists where unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. The flaw is triggered via the `alldata[truebooker user]` parameter. Exploitation requires that the `alldata` POST parameter includes specific booking fields: category, service, person, date, and time slot. The `check ajax referer()` nonce guard does not prevent this attack because the nonce is exposed to unauthenticated visitors on the front-end booking pages. **Recommendations** Update to a version newer than 1.2.2. As a temporary mitigation, restrict or monitor the use of the `alldata[truebooker user]` parameter in POST requests.