CVE-2023-29839

What it actually does

Stored XSS allows persistent injection of arbitrary JavaScript into the Surname, Name, and Nickname fields of the Document function; the payload is saved server-side and later executed in the browser context of any user who views the affected record, with the CVSS vector indicating network attack vector, low complexity, low-privileged authenticated attacker, and reflected impact on confidentiality and integrity within the same origin.

Why it matters to the business

Compromise of the hotel management application can lead to session hijacking of staff accounts, unauthorized viewing or alteration of guest records, and potential lateral movement inside the organization; the vulnerability has been public for over three years with available exploit code but no listed fixed versions, increasing long-term exposure for any remaining deployments.

How an attack unfolds

An authenticated low-privileged user supplies a malicious script payload in one of the three vulnerable name fields; the payload is stored without sanitization; when any other user (including higher-privileged staff) later opens the Document view containing that record, the script executes in their browser, enabling theft of cookies, keylogging, or actions on behalf of the victim.

How to fix it

Upgrade to the latest version of Hotel Druid once a fix is released; until then apply input sanitization or output encoding on the three affected fields, deploy a web application firewall rule that strips or blocks script tags and event handlers, and restrict which roles can create or view Document records.

How to confirm the fix worked

Review the source of any Document view page for unencoded user-controlled fields; attempt to store and retrieve a benign test payload such as an image onerror handler and confirm it does not execute; retest after applying sanitization or WAF rules.

Typical attack path

1. Obtain a low-privileged account or use a guest submission path that reaches the Document function
2. Insert a crafted script payload into Surname, Name, or Nickname
3. Trigger storage of the record
4. Wait for or lure a privileged user to view the record
5. Execute actions via the running script such as session theft or data exfiltration

How to detect it

Search web server and application logs for requests that POST or PUT to Document endpoints containing HTML tags or event handlers in the surname, name, or nickname parameters; inspect database records for stored script content; review browser console or proxy captures for unexpected script execution on Document view pages.

• <script
• onerror=
• onload=
• javascript:
• Document.*surname
• Document.*name
• Document.*nickname

What your security team should do

• Immediately inventory all Hotel Druid 3.0.4 installations and isolate them from the internet if possible
• Implement output encoding and content-security-policy headers on all Document-related pages
• Monitor application logs and web traffic for script-related patterns in the named fields
• Plan migration to a supported version or alternative product given the absence of listed fixes