📄 Description (English)
Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover.
🤖 AI Executive Summary
Easy!Appointments versions 1.5.2 and earlier contain a critical CSRF vulnerability in csrf_verify() that only protects POST requests, allowing attackers to perform state-changing operations via GET requests. This enables unauthorized creation of admin accounts, modification of admin credentials, and complete admin account takeover through crafted links or embedded requests. The vulnerability is actively exploitable and patches are available.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: Apr 22, 2026 18:41
🇸🇦 Saudi Arabia Impact Assessment
Saudi healthcare providers, private clinics, and dental practices using Easy!Appointments for patient scheduling face critical risk of admin account compromise. Government health facilities under MOH and private sector clinics could experience service disruption and data breach. Banking sector's appointment systems and ARAMCO's facility scheduling systems are at risk. Telecom providers (STC, Mobily, Zain) using this platform for customer service appointments could face operational disruption. The vulnerability enables complete system takeover without authentication, making it particularly dangerous for organizations handling sensitive patient or customer data under GDPR and Saudi data protection regulations.
🏢 Affected Saudi Sectors
Healthcare (MOH facilities, private clinics, dental practices)
Banking and Financial Services
Energy (ARAMCO, utilities)
Telecommunications (STC, Mobily, Zain)
Government Services
Private Sector Service Providers
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
9.2
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Identify all Easy!Appointments instances in your environment and document versions
2. Disable public access to Easy!Appointments if possible or restrict to VPN/internal networks only
3. Review admin account creation logs and audit all admin accounts for unauthorized additions
4. Force password reset for all admin accounts immediately
5. Check email settings and verify no unauthorized email changes were made
PATCHING:
1. Upgrade Easy!Appointments to version 1.5.3 or later immediately
2. Apply patches to all instances including development and staging environments
3. Test functionality thoroughly after patching before production deployment
COMPENSATING CONTROLS (if immediate patching not possible):
1. Implement Web Application Firewall (WAF) rules to block GET requests to sensitive endpoints (admin creation, settings modification)
2. Deploy reverse proxy with CSRF token validation for all state-changing operations
3. Implement strict Content Security Policy (CSP) headers
4. Enable HTTP-only and Secure flags on all cookies
5. Restrict access to Easy!Appointments admin panel to specific IP ranges
6. Implement rate limiting on admin-related endpoints
DETECTION:
1. Monitor for GET requests to /admin/appointments/save, /admin/users/save, /admin/settings/save endpoints
2. Alert on admin account creation events without corresponding login activity
3. Monitor for email configuration changes in application logs
4. Track failed CSRF token validations in web server logs
5. Implement IDS signatures for Easy!Appointments CSRF exploitation patterns
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. حدد جميع نسخ Easy!Appointments في بيئتك وتوثيق الإصدارات
2. عطل الوصول العام إلى Easy!Appointments إن أمكن أو قيده على الشبكات الداخلية/VPN فقط
3. راجع سجلات إنشاء حساب الإدارة وتدقيق جميع حسابات الإدارة للإضافات غير المصرح بها
4. فرض إعادة تعيين كلمة المرور لجميع حسابات الإدارة فوراً
5. تحقق من إعدادات البريد الإلكتروني والتحقق من عدم إجراء أي تغييرات بريد إلكتروني غير مصرح بها
التصحيح:
1. ترقية Easy!Appointments إلى الإصدار 1.5.3 أو أحدث فوراً
2. تطبيق التصحيحات على جميع النسخ بما في ذلك بيئات التطوير والاختبار
3. اختبر الوظائف بعناية بعد التصحيح قبل نشر الإنتاج
الضوابط البديلة (إذا لم يكن التصحيح الفوري ممكناً):
1. تنفيذ قواعد جدار حماية تطبيقات الويب (WAF) لحظر طلبات GET للنقاط النهائية الحساسة
2. نشر وكيل عكسي مع التحقق من رمز CSRF لجميع العمليات التي تغير الحالة
3. تنفيذ رؤوس سياسة أمان المحتوى (CSP) صارمة
4. تفعيل أعلام HTTP-only و Secure على جميع ملفات تعريف الارتباط
5. تقييد الوصول إلى لوحة إدارة Easy!Appointments على نطاقات IP محددة
6. تنفيذ تحديد معدل على نقاط نهاية متعلقة بالإدارة
الكشف:
1. مراقبة طلبات GET إلى نقاط النهاية الحساسة
2. تنبيه أحداث إنشاء حساب الإدارة بدون نشاط تسجيل دخول مقابل
3. مراقبة تغييرات تكوين البريد الإلكتروني في سجلات التطبيق
4. تتبع فشل التحقق من رمز CSRF في سجلات خادم الويب
5. تنفيذ توقيعات IDS لأنماط استغلال CSRF في Easy!Appointments
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
5.1 - Access Control and Authentication
5.2 - Authorization and Access Rights Management
6.1 - Security of Data in Transit
6.2 - Security of Data at Rest
7.1 - Incident Detection and Response
8.1 - Security Awareness and Training
🔵 SAMA CSF
Governance - Risk Management Framework
Protective - Access Control
Protective - Data Protection
Responsive - Incident Response
Responsive - Business Continuity
🟡 ISO 27001:2022
A.5.1 - Policies for information security
A.5.2 - Information security roles and responsibilities
A.6.1 - Screening
A.8.1 - User endpoint devices
A.8.2 - Privileged access rights
A.8.3 - Information access restriction
A.13.1 - Network security perimeter
A.14.1 - Information security requirements analysis and specification
🟣 PCI DSS v4.0.1
Requirement 6.5.9 - Protection against CSRF attacks
Requirement 7.1 - Limit access to system components
Requirement 8.1 - Assign unique ID to each person
Requirement 8.2 - Ensure proper user authentication
🔗 References & Sources 2
🔗
https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj
security-advisories@github.com
Vendor Advisory
Exploit
🔗
https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj
134c704f-9b21-4f2e-91b3-4a467353bcc0
Vendor Advisory
Exploit
📦 Affected Products / CPE 1 entries
easyappointments:easy\!appointments