The Meeting Room Booking System (MRBS), a PHP-based application for booking meeting rooms, has an open redirect vulnerability (CWE-601) in versions before 1.12.2. This vulnerability allows unauthenticated requests to redirect users to arbitrary URLs specified in the query parameters. An attacker can exploit this by sending a specially crafted URL to users, causing them to be redirected to malicious sites such as spoofed login pages. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity. The issue is fixed in MRBS version 1.12.2.

Successful exploitation can lead to users being redirected to attacker-controlled sites, which may be used for phishing or other social engineering attacks. There is no direct compromise of the MRBS system itself, but user trust and credentials could be at risk if users are tricked by the redirection.

Upgrade MRBS installations to version 1.12.2 or later, which contains the official fix for this open redirect vulnerability. No known workarounds are available, so patching is the recommended remediation.