CVE-2020-37077: Booked Scheduler Path Traversal Flaw

CVE-2020-37077 Overview

Booked Scheduler 2.7.7 contains a directory traversal vulnerability (CWE-22) in the manage_email_templates.php script that allows authenticated administrators to access unauthorized files. Attackers can exploit the vulnerable tn parameter to read files outside the intended directory by manipulating directory path traversal techniques. This vulnerability affects the email template management functionality and could lead to exposure of sensitive system files.

Critical Impact

Authenticated administrators can exploit path traversal sequences to read arbitrary files on the server, potentially exposing configuration files, credentials, and other sensitive data.

Affected Products

• Booked Scheduler 2.7.7
• Earlier versions of Booked Scheduler may also be affected

Discovery Timeline

• 2026-02-03 - CVE CVE-2020-37077 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2020-37077

Vulnerability Analysis

This directory traversal vulnerability exists in the email template management functionality of Booked Scheduler. The manage_email_templates.php script fails to properly sanitize user-supplied input in the tn parameter, which is used to specify email template names. Without adequate input validation, an attacker with administrative privileges can craft malicious requests containing path traversal sequences (such as ../) to escape the intended template directory and access files elsewhere on the file system.

The vulnerability requires authentication with administrative privileges, which limits the attack surface but still presents significant risk in multi-admin environments or scenarios where admin credentials have been compromised. Successful exploitation allows reading of arbitrary files that the web server process has permission to access, potentially including sensitive configuration files, database credentials, or system files like /etc/passwd.

Root Cause

The root cause of this vulnerability is improper input validation and lack of path canonicalization in the manage_email_templates.php script. The application fails to properly sanitize the tn parameter before using it to construct file paths. Specifically, the code does not strip or reject directory traversal sequences (../ or ..\) from user input, allowing attackers to navigate outside the intended email templates directory.

Attack Vector

The attack is executed over the network by an authenticated administrator sending a crafted HTTP request to the manage_email_templates.php endpoint. The malicious request includes path traversal sequences in the tn parameter to specify a file outside the template directory. For example, an attacker might use sequences like ../../../etc/passwd to read system files or ../../../config/config.php to access database credentials.

The attacker needs valid administrative credentials to execute this attack, as the vulnerable endpoint is protected behind authentication. Once authenticated, the attacker can systematically probe the file system to locate and exfiltrate sensitive files. For detailed technical information and proof-of-concept details, refer to the Exploit-DB entry #48428 and the VulnCheck Advisory.

Detection Methods for CVE-2020-37077

Indicators of Compromise

• HTTP requests to manage_email_templates.php containing path traversal sequences (../, ..\, %2e%2e%2f, or %2e%2e/) in the tn parameter
• Web server access logs showing unusual patterns of requests to the email template management endpoint
• Unexpected file access attempts or errors in system logs related to files outside the application directory
• Evidence of sensitive file contents being read through the application (e.g., configuration data exposure)

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing path traversal patterns in URL parameters
• Monitor web server access logs for suspicious requests to manage_email_templates.php with encoded or literal traversal sequences
• Configure file integrity monitoring to detect unauthorized read access to sensitive configuration files
• Deploy SentinelOne Singularity to detect anomalous file system access patterns from web server processes

Monitoring Recommendations

• Enable verbose logging for the Booked Scheduler application to capture all file access operations
• Set up alerts for requests containing ../ or URL-encoded equivalents targeting email template endpoints
• Monitor administrator account activity for unusual access patterns or bulk file reading attempts
• Review web server error logs for "file not found" or permission denied errors that may indicate traversal attempts

How to Mitigate CVE-2020-37077

Immediate Actions Required

• Restrict administrative access to Booked Scheduler to only trusted users and limit the number of admin accounts
• Implement network-level access controls to limit access to the admin panel from trusted IP addresses only
• Deploy a Web Application Firewall (WAF) with rules to block path traversal attempts
• Review admin account credentials and enforce strong password policies
• Consider taking the application offline until a patch is applied if the risk is deemed unacceptable

Patch Information

Administrators should check the Booked Scheduler Official Site for any available security updates or patches that address this vulnerability. If no official patch is available, consider implementing the workarounds below or consulting with the vendor for remediation guidance. The historical source code may be available at the SourceForge Archive for reference.

Workarounds

• Implement input validation at the web server level using mod_security or similar modules to block requests containing path traversal sequences
• Add PHP-level input sanitization by modifying the manage_email_templates.php file to use basename() or realpath() functions to prevent directory traversal
• Restrict file system permissions so the web server user can only access necessary directories
• Use chroot or containerization to isolate the web application and limit the impact of successful exploitation
• Consider disabling the email template management feature if it is not required for your deployment

The following Apache configuration can help block path traversal attempts at the web server level:

# Block path traversal attempts in query strings
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# Alternatively with mod_security
SecRule ARGS "@contains ../" "id:1001,phase:2,deny,status:403,msg:'Path Traversal Attempt'"