CVE-2021-37833

MEDIUMNuclei

Hotel Druid 3.0.2 - Cross-Site Scripting

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-37833 has a selected CVSS score of 6.1 (medium); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

A reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

Proofs of concept

1

Repository PoCs

GitHubdievus/CVE-2021-37833Repository PoCby dievus2Not analyzed1 file

1.3 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMHotel Druid 3.0.2 - Cross-Site ScriptingCVSS 6.1

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Remediation

To remediate this issue, it is recommended to implement proper input validation and sanitization techniques to prevent the execution of malicious scripts.

WeaknessesCWE-79
Authorspikpikcu, s4e-io
Template tagscve2021cvehoteldruidxssdigitaldruidvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:digitaldruid:hoteldruid:3.0.2:*:*:*:*:*:*:*
Shodan: http.title:"hoteldruid"
Shodan: http.favicon.hash:-1521640213
FOFA: title="hoteldruid"
FOFA: icon_hash=-1521640213
Google: intitle:"hoteldruid"
https://github.com/dievus/CVE-2021-37833 https://www.hoteldruid.com/ https://nvd.nist.gov/vuln/detail/CVE-2021-37833

Source: ProjectDiscovery

References

3