Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-43374: Hoteldruid 3.0.5 lets attackers manipulate database via URL

CVE-2023-43374 · published 3 years ago

Summary

The HotelDruid version 3.0.5 web tool can be tricked into running unintended database commands when a specially crafted value is sent to the id_utente_log field on the personalizza.php page. This could let an attacker view, change, or delete data. Apply the latest software update or contact the vendor for a patch and review input handling on that page.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	hoteldruid	All versions
–	digitaldruid	hoteldruid	3.0.5 `cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:::::::*`

Original advisory text

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php.

References

https://security-tracker.debian.org/tracker/CVE-2023-43374 Vendor Advisory
https://flashy-lemonade-192.notion.site/SQL-injection-in-hoteldruid-version-3-0-... Exploit Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

4% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published20 Sep 2023

Updated4 Nov 2026

First seen1 Sep 2026

Sources

DEBIAN-CVE-2023-43374 · OSV

CVE-2023-43374 · NVD

Track software like this

Free during beta