PT-2019-19270 · Digitaldruid · Hoteldruid

Mehmet Emiroglu · Published 2019-05-17 · Updated 2019-05-17 · CVE-2019-8937

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HotelDruid version 2.3.0

Description The issue affects the nsextt, cambia1, mese fine, origine, and anno parameters in several PHP files, including creaprezzi.php, tabella3.php, personalizza.php, and visualizza tabelle.php, allowing for XSS exploitation.

Recommendations For HotelDruid version 2.3.0, consider restricting access to the affected PHP files until a patch is available. As a temporary workaround, avoid using the nsextt, cambia1, mese fine, origine, and anno parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-8937

Affected Products

Hoteldruid

References · 10

• 🔥 https://exploit-db.com/exploits/46429 · Exploit
• 🔥 http://packetstormsecurity.com/files/151779/HotelDruid-2.3-Cross-Site-Scripting.html · Exploit
• https://ubuntu.com/security/CVE-2019-8937 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-8937 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-8937 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-8937 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8937 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-8937 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-8937 · Vendor Advisory
• https://sourceforge.net/projects/hoteldruid · Note