Session Token Exposure in HotelDruid Hotel Management Software
CVE-2021-42948

3.7LOW

Key Information:

Vendor

Digitaldruid

Status
Hoteldruid
Vendor
CVE Published:
16 September 2022

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2021-42948?

HotelDruid Hotel Management Software versions 3.0.3 and earlier have a serious vulnerability where session tokens are exposed through GET parameters in various URLs. This flaw can allow attackers to capture user session IDs, potentially leading to unauthorized access to user accounts and sensitive information. It is essential for users of affected versions to take immediate action to secure their applications and update to the latest version to mitigate the risk.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

HotelDruid-CVE-2021-42948
Created by dhammon

References

https://www.hoteldruid.com/
x_refsource_MISC
https://github.com/dhammon/Security
x_refsource_MISC
https://github.com/dhammon/HotelDruid-CVE-2021-42948
x_refsource_MISC

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.