CVE-2022-26564

What it actually does

The vulnerability permits arbitrary JavaScript injection through the unsanitized prezzoperiodo4 parameter in creaprezzi.php, executing in victims' browsers with the application's origin.

Why it matters to the business

Successful exploitation can result in theft of user sessions, unauthorized actions within the hotel management system, or delivery of malware, disrupting operations and exposing guest or booking data.

How an attack unfolds

An attacker embeds a malicious script in the prezzoperiodo4 parameter of a crafted URL to creaprezzi.php and delivers the link to an authenticated user via phishing or a compromised site; when the victim loads the page the script runs, enabling session hijacking or further attacks. The weaponized exploit maturity indicates public proof-of-concept code is available for reuse.

How to fix it

Upgrade HotelDruid to the latest available version that addresses the input handling flaw; sanitize and encode all user-supplied values for prezzoperiodo4 and similar parameters; deploy a web application firewall with XSS filtering rules; enforce a strict Content-Security-Policy header.

How to confirm the fix worked

Inspect creaprezzi.php source for proper escaping or filtering of the prezzoperiodo4 parameter; attempt reflected XSS test payloads in a controlled environment and confirm they are blocked; review HTTP responses for absence of unencoded script content.

Typical attack path

1. Identify and craft a URL containing an XSS payload in the prezzoperiodo4 parameter of creaprezzi.php
2. Deliver the malicious link through phishing email, chat, or compromised website
3. Authenticated user clicks the link and loads the page
4. Injected script executes in the victim's browser context to exfiltrate cookies, tokens, or perform actions

How to detect it

Search web server and application logs for requests to creaprezzi.php containing script, javascript, or encoded tags in the prezzoperiodo4 parameter; inspect browser histories or proxy logs for unexpected redirects or data exfiltration originating from that endpoint.

• creaprezzi.php?prezzoperiodo4=
• prezzoperiodo4=%3Cscript
• prezzoperiodo4=%3Cimg%20src%3Dx%20onerror
• prezzoperiodo4=javascript:

What your security team should do

• Prioritize patching HotelDruid as soon as a fixed release is published given weaponized exploit availability
• Deploy WAF rules blocking common XSS patterns in query parameters to creaprezzi.php
• Monitor application logs for anomalous prezzoperiodo4 values containing script tags or event handlers
• Conduct user awareness training on recognizing suspicious links to the hotel management interface