id: unauth-hoteldruid-panel

info:
  name: Hoteldruid Management Panel Access
  author: princechaddha
  severity: high
  description: A vulnerability in Hoteldruid Panel allows remote unauthenticated users access to the management portal without authentication.
  reference:
    - https://github.com/nomi-sec/PoC-in-GitHub/blob/master/2021/CVE-2021-42949.json
    - https://www.hoteldruid.com/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cwe-id: CWE-522
  metadata:
    max-request: 2
  tags: hoteldruid,panel,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/hoteldruid/inizio.php"
      - "{{BaseURL}}/inizio.php"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "<title> HotelDruid </title>"
          - "<b>INSERT:</b>"
          - "<b>TABLES:</b>"
        condition: and

# digest: 4b0a00483046022100b167cc0851722d7c32a687f0349ff4aeb493bfa181a2bafa03726b549b68c194022100a9e8558089ffe0f9a1b3900510ed9a46ed69d19f65e2e77f076e8dae01f1410a:922c64590222798bb761d5b6d8e72950