CVE-2023-43374

CRITICALNuclei

Hoteldruid v3.0.5 - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-43374 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 24, 2024 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryCRITICALHoteldruid v3.0.5 - SQL InjectionCVSS 9.8

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php.

Impact

Successful exploitation could lead to unauthorized access to sensitive data or complete takeover of the affected system.

Remediation

Upgrade Hoteldruid to a patched version that addresses the SQL Injection vulnerability.

WeaknessesCWE-89
Authorsritikchaddha
Template tagstime-based-sqlicvecve2023hoteldruidcmssqlidigitaldruidvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*
Shodan: title:"HotelDruid"
Shodan: http.title:"hoteldruid"
Shodan: http.favicon.hash:-1521640213
FOFA: title="HotelDruid"
FOFA: title="hoteldruid"
FOFA: icon_hash=-1521640213
Google: intitle:"hoteldruid"
https://flashy-lemonade-192.notion.site/SQL-injection-in-hoteldruid-version-3-0-5-via-id_utente_log-parameter-8b89f014004947e7bd2ecdacf1610cf9 https://nvd.nist.gov/vuln/detail/CVE-2023-43374

Source: ProjectDiscovery

References

2