Cross-Site Scripting Vulnerability in Hoteldruid by Artica
CVE-2023-43376

5.4MEDIUM

Key Information:

Vendor

Digitaldruid

Status
Hoteldruid
Vendor
CVE Published:
20 September 2023

What is CVE-2023-43376?

Hoteldruid v3.0.5 has a cross-site scripting vulnerability located in the /hoteldruid/clienti.php file. This flaw allows attackers to execute arbitrary web scripts or HTML by injecting malicious payloads, specifically through the nometipotariffa1 parameter. Successful exploitation of this vulnerability can lead to severe security breaches, allowing unauthorized actions to be performed by the attacker.

References

https://flashy-lemonade-192.notion.site/Cross-site-script...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.