CVE-2023-43374 Scanner

Hoteldruid is a comprehensive property management system used by hotels, resorts, and other hospitality businesses to manage reservations, billing, guest check-ins, and daily operations. It is typically deployed by hotel administrators and IT staff to streamline workflows and maintain accurate customer records. The software's flexibility allows customization for various property sizes, making it a popular choice in the hospitality industry.

SQL Injection vulnerability CVE-2023-43374 arises when user-supplied input is not properly sanitized before being used in SQL queries. In Hoteldruid, this flaw occurs because the application directly concatenates user input into SQL statements without adequate validation or escaping. Attackers can exploit this by injecting malicious SQL code through vulnerable parameters.

The vulnerability specifically targets the id_utente_log parameter within the personalizza.php script. By manipulating this parameter, an attacker can inject arbitrary SQL commands that the database executes. This allows them to bypass authentication, retrieve sensitive data, or modify database contents without proper authorization.

If exploited, this vulnerability can lead to complete compromise of the Hoteldruid database, exposing guest personal information, payment details, and booking records. Attackers may also gain administrative access, alter reservations, or disrupt hotel operations. The critical CVSS score of 9.8 underscores the severe impact on confidentiality, integrity, and availability.