CVE-2025-29448: Easy!Appointments DoS Vulnerability

CVE-2025-29448 Overview

CVE-2025-29448 is a business logic vulnerability in Easy!Appointments v1.5.1, an open-source web-based appointment scheduling system. The flaw resides in the booking workflow, which fails to enforce reasonable limits on appointment duration. Unauthenticated attackers can submit booking requests with excessively long durations, monopolizing the calendar and preventing legitimate users from scheduling appointments. The result is a denial-of-service condition affecting all future booking availability.

The vulnerability is reachable over the network without authentication or user interaction, making it trivial to exploit against any internet-exposed Easy!Appointments instance.

Critical Impact

Unauthenticated remote attackers can permanently block appointment booking by reserving slots with arbitrarily long durations, denying service to legitimate users.

Affected Products

• Easy!Appointments v1.5.1
• Vendor: easyappointments
• Open-source PHP-based scheduling application

Discovery Timeline

• 2025-05-07 - CVE-2025-29448 published to NVD
• 2026-01-28 - Last updated in NVD database

Technical Details for CVE-2025-29448

Vulnerability Analysis

CVE-2025-29448 is a business logic flaw [CWE-284: Improper Access Control] in the appointment creation endpoint of Easy!Appointments v1.5.1. The application accepts the end_datetime field from client-supplied booking input without validating it against acceptable business constraints, such as maximum service duration or provider working hours.

An attacker can submit a single booking request that spans days, months, or years. Because the scheduling engine treats the slot as occupied, all subsequent booking attempts that overlap the reserved window are rejected. Repeating this against multiple providers or services blocks the entire calendar.

The issue affects availability only — confidentiality and integrity are not impacted — but the unauthenticated attack surface makes the flaw practical against any public-facing instance.

Root Cause

The root cause is missing server-side validation of appointment duration during booking creation. The application trusts client-supplied start and end timestamps and does not constrain duration to the configured service length. No rate limiting, CAPTCHA, or account requirement gates the public booking endpoint.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker submits crafted HTTP POST requests to the public booking API, specifying an end_datetime far in the future relative to start_datetime. Because no authentication is required and no duration ceiling is enforced, the malicious appointment is accepted and stored, blocking the affected provider's schedule.

Refer to the GitHub PoC repository for CVE-2025-29448 for technical reproduction details.

Detection Methods for CVE-2025-29448

Indicators of Compromise

• Appointment records with durations significantly exceeding configured service length (for example, multi-day or multi-week bookings).
• Bookings created with attendee details that are repeated, randomized, or clearly synthetic.
• Spikes in POST requests to the appointment creation endpoint from a small set of source IPs.
• Sudden disappearance of available booking slots across providers without corresponding business activity.

Detection Strategies

• Query the appointments database for entries where end_datetime - start_datetime exceeds the maximum configured service duration.
• Inspect web server access logs for unauthenticated booking submissions and correlate by source IP, user-agent, and frequency.
• Monitor application logs for booking creation events outside of normal customer-facing patterns.

Monitoring Recommendations

• Alert on any single appointment whose duration exceeds a defined threshold (for example, 24 hours).
• Track booking creation rate per source IP and flag anomalies.
• Review calendar fill rate daily to detect rapid exhaustion of availability.

How to Mitigate CVE-2025-29448

Immediate Actions Required

• Audit existing appointments and remove records with abnormally long durations.
• Restrict access to the public booking endpoint via IP allowlisting or a web application firewall (WAF) rule rejecting requests where the duration field exceeds expected service length.
• Apply rate limiting to the booking endpoint to slow automated abuse.
• Require CAPTCHA or email verification before persisting bookings where feasible.

Patch Information

No vendor-supplied security patch is referenced in the NVD record at the time of publication. Monitor the Easy!Appointments project repository and the public PoC and advisory for CVE-2025-29448 for fix availability and upgrade guidance.

Workarounds

• Add server-side validation to enforce that appointment duration matches the selected service definition.
• Place the booking endpoint behind a WAF rule that rejects requests with end_datetime more than the configured service length after start_datetime.
• Implement per-IP and per-email rate limits on the booking API.
• Temporarily require authentication or out-of-band verification for new bookings while a permanent fix is unavailable.

# Example WAF/reverse-proxy guidance (pseudocode)
# Reject booking POSTs where requested duration exceeds 4 hours
if request.path == "/index.php/appointments/ajax_register_appointment" \
   and (request.body.end_datetime - request.body.start_datetime) > 4h:
    return 400 "Invalid appointment duration"