The vulnerability identified as CVE-2024-49304 involves a CSRF flaw in the DOTonPAPER Pinpoint Booking System, which can be exploited to inject Stored XSS payloads. The affected versions include all releases up to and including 2.9.9.5.7. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but user interaction is needed. The impact includes limited integrity and availability consequences but no confidentiality loss. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute stored cross-site scripting attacks via CSRF, potentially impacting the integrity and availability of the affected system. There is no indication of confidentiality compromise. The vulnerability requires user interaction and can be exploited remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as anti-CSRF tokens and validating user requests. Monitoring for suspicious activity related to stored XSS attempts is advisable. Avoid relying solely on user interaction as a defense.