PT-2019-19270 · Digitaldruid · Hoteldruid

Mehmet Emiroglu · Publicado 2019-05-17 · Atualizado 2019-05-17 · CVE-2019-8937

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HotelDruid version 2.3.0

Description The issue affects the nsextt, cambia1, mese fine, origine, and anno parameters in several PHP files, including creaprezzi.php, tabella3.php, personalizza.php, and visualizza tabelle.php, allowing for XSS exploitation.

Recommendations For HotelDruid version 2.3.0, consider restricting access to the affected PHP files until a patch is available. As a temporary workaround, avoid using the nsextt, cambia1, mese fine, origine, and anno parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-8937

Produtos afetados

Hoteldruid

Referências · 10

• 🔥 https://exploit-db.com/exploits/46429 · Exploit
• 🔥 http://packetstormsecurity.com/files/151779/HotelDruid-2.3-Cross-Site-Scripting.html · Exploit
• https://ubuntu.com/security/CVE-2019-8937 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-8937 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2019-8937 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-8937 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-8937 · Nota de Segurança
• https://sourceforge.net/projects/hoteldruid · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-8937 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-8937 · Aviso do Fabricante