CVE-2023-33817
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
Version 3.0.5 of hoteldruid was found to contain a SQL injection vulnerability.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to the database, potentially leading to the disclosure of sensitive information.
Recommendation
It is recommended to update hoteldruid to the latest version to mitigate this vulnerability.
Other vulnerabilities in hoteldruid v3.0.5
See all- CVE-2025-44203High
In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup completion, causing a race condition during database creation. Sending many concurrent requests can disclose the administrator username, password hash, and salt, and leave the setup partially initialized, preventing login and requiring reinstallation.
- CVE-2023-34537Medium
A Reflected XSS vulnerability was discovered in HotelDruid version 3.0.5, allowing an attacker to inject malicious code into webpage parameters, potentially tricking users in their browsers or exfiltrating data.
Original NVD description (English source)
hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability.