CVE-2022-22909

This exploit targets Hotel Druid 3.0.3, leveraging a command injection vulnerability in the room addition functionality to achieve remote code execution. It automates login, privilege checks, and payload delivery via the 'n_app' parameter.

This repository contains a functional exploit for CVE-2022-22909, a code injection vulnerability in Hotel Druid v3.0.3. The exploit leverages improper handling of room names in `/dati/selectappartamenti.php` to achieve remote code execution by injecting a PHP payload.

This repository contains two Python scripts demonstrating remote code execution (RCE) in Hotel Druid 3.0.3 via CVE-2022-22909. The exploit leverages PHP code injection in room names, which are stored in a PHP file and executed by the server.