Cross-Site Scripting Vulnerability in Hoteldruid by Hoteldruid
CVE-2023-43377

5.4MEDIUM

Key Information:

Vendor

Digitaldruid

Status
Hoteldruid
Vendor
CVE Published:
20 September 2023

What is CVE-2023-43377?

This vulnerability in Hoteldruid version 3.0.5 enables attackers to perform cross-site scripting attacks. By injecting a malicious payload into the 'destinatario_email1' parameter of the 'visualizza_contratto.php' file, an attacker can execute arbitrary scripts or HTML within a user's browser. This can lead to data theft, session hijacking, or other malicious exploits, showcasing the critical need for robust input validation and security measures in web applications.

References

https://flashy-lemonade-192.notion.site/Cross-site-script...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.