CVE-2024-37231: Salon Booking System Path Traversal Flaw

CVE-2024-37231 Overview

CVE-2024-37231 is a critical path traversal vulnerability affecting the Salon Booking System plugin for WordPress. This vulnerability, classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), allows unauthenticated attackers to manipulate file paths and potentially delete arbitrary files on the affected WordPress installation.

Critical Impact

This path traversal vulnerability enables arbitrary file deletion without authentication, which can lead to complete site compromise, denial of service, or potential remote code execution when combined with other attack vectors.

Affected Products

• Salon Booking System plugin for WordPress versions through 9.9
• WordPress installations running vulnerable versions of the Salon Booking System plugin

Discovery Timeline

• June 24, 2024 - CVE-2024-37231 published to NVD
• April 11, 2025 - Last updated in NVD database

Technical Details for CVE-2024-37231

Vulnerability Analysis

This path traversal vulnerability exists in the Salon Booking System WordPress plugin due to improper sanitization of user-controlled file path inputs. The vulnerability allows attackers to bypass intended directory restrictions by manipulating file path parameters, enabling them to reference and delete files outside of the expected directories.

The attack can be executed remotely over the network with low complexity and requires no authentication or user interaction. While the vulnerability does not directly expose confidential data, successful exploitation can result in high-impact damage to system integrity through arbitrary file deletion and availability disruption by removing critical WordPress files.

Root Cause

The root cause of CVE-2024-37231 is insufficient input validation and sanitization of user-supplied file path parameters within the Salon Booking System plugin. The application fails to properly validate and canonicalize file paths before performing file operations, allowing directory traversal sequences (such as ../) to escape the intended directory constraints.

Attack Vector

The vulnerability is exploitable via network-based requests to the WordPress installation. An attacker can craft malicious requests containing path traversal sequences to target arbitrary files on the server filesystem. By manipulating file path parameters, attackers can traverse outside the plugin's intended directory scope and delete critical system files.

Common attack scenarios include:

• Deleting the wp-config.php file to cause denial of service or trigger WordPress reinstallation
• Removing security-related files to weaken the site's defenses
• Deleting plugin or theme files to disable security mechanisms
• Targeting backup files to eliminate recovery options

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-37231

Indicators of Compromise

• Unexpected file deletions in WordPress installation directories
• HTTP requests to Salon Booking System plugin endpoints containing path traversal patterns (../, ..%2f, ..%5c)
• Sudden site malfunctions due to missing critical WordPress files
• Web server error logs showing attempts to access files outside plugin directories

Detection Strategies

• Monitor web server access logs for requests containing directory traversal sequences targeting the Salon Booking System plugin
• Implement web application firewall (WAF) rules to detect and block path traversal patterns in HTTP parameters
• Deploy file integrity monitoring (FIM) solutions to alert on unauthorized file deletions
• Review WordPress error logs for unusual plugin-related file operation failures

Monitoring Recommendations

• Enable detailed logging for the Salon Booking System plugin and WordPress file operations
• Configure real-time alerts for file deletion events in WordPress core directories
• Implement anomaly detection for unusual request patterns to plugin endpoints
• Regularly audit installed plugin versions against known vulnerability databases

How to Mitigate CVE-2024-37231

Immediate Actions Required

• Update the Salon Booking System plugin to a version newer than 9.9 that addresses this vulnerability
• If immediate update is not possible, temporarily disable the Salon Booking System plugin
• Review server access logs for evidence of exploitation attempts
• Verify file integrity of WordPress installation using tools like wp-cli or manual checksums
• Ensure regular backups are in place and stored securely off-server

Patch Information

Users should update the Salon Booking System plugin to the latest available version from the official WordPress plugin repository. The vulnerability affects all versions through 9.9. Check the Patchstack advisory for confirmation of patched versions.

Workarounds

• Temporarily disable the Salon Booking System plugin until a patched version can be installed
• Implement WAF rules to block requests containing path traversal sequences (../, encoded variants)
• Restrict file system permissions to limit the web server user's ability to delete files outside the uploads directory
• Consider using WordPress security plugins that provide virtual patching capabilities for known vulnerabilities

# WordPress CLI command to check plugin version
wp plugin list --name=salon-booking-system --fields=name,version,update_version

# Disable the vulnerable plugin temporarily
wp plugin deactivate salon-booking-system

# Update the plugin to the latest version
wp plugin update salon-booking-system

# Verify WordPress core file integrity
wp core verify-checksums