unauth-hoteldruid-panel: Hoteldruid Management Panel Access

id: unauth-hoteldruid-panel

info:
  name: Hoteldruid Management Panel Access
  author: princechaddha
  severity: high
  description: A vulnerability in Hoteldruid Panel allows remote unauthenticated users access to the management portal without authentication.
  reference:
    - https://github.com/nomi-sec/PoC-in-GitHub/blob/master/2021/CVE-2021-42949.json
    - https://www.hoteldruid.com/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cwe-id: CWE-522
  metadata:
    max-request: 2
  tags: hoteldruid,panel,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/hoteldruid/inizio.php"
      - "{{BaseURL}}/inizio.php"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "<title> HotelDruid </title>"
          - "<b>INSERT:</b>"
          - "<b>TABLES:</b>"
        condition: and
# digest: 4a0a00473045022100862b574e22609bb49ca82d516825659f472b1e443becbf234f214eca1cc6e1d602200ae4089e79ab728da678ee2cf02422562241b39a755f34f24530aeae3a959ce4:922c64590222798bb761d5b6d8e72950