CVE-2023-43371

What it actually does

Unauthenticated remote SQL injection via the numcaselle parameter allowing arbitrary database queries that can read, modify, or delete data.

Why it matters to the business

Attackers may steal or alter sensitive customer and operational records stored by the application, causing data loss, regulatory exposure, and service disruption; the vulnerability affects widely deployed packages with a growing exploitation probability.

How an attack unfolds

An attacker locates the creaprezzi.php endpoint and submits a crafted numcaselle value containing SQL syntax; the unsanitized input is concatenated into a query, enabling data exfiltration or further database manipulation without authentication.

How to fix it

Upgrade thunderbird to 1:115.7.0-1~deb11u1 (Debian 11), 1:115.7.0-1~deb12u1 (Debian 12), or 1:115.7.0-1 (Debian 13); upgrade firefox-esr to 115.7.0esr-1~deb11u1 (Debian 11), 115.7.0esr-1~deb12u1 (Debian 12), or 115.7.0esr-1 (Debian 13). Apply vendor patches immediately given the 1122 days since publication and rising EPSS trend.

How to confirm the fix worked

Confirm the installed package versions match or exceed the listed fixed releases; retest the numcaselle parameter with known-safe input to verify query parameterization.

Typical attack path

1. Discover the /hoteldruid/creaprezzi.php endpoint
2. Inject SQL payload through the numcaselle parameter
3. Observe database error or data leakage in responses
4. Escalate to data extraction or destructive queries

How to detect it

Inspect web server access logs for requests to creaprezzi.php containing SQL keywords or unusual numcaselle values; correlate with database query logs showing unexpected clauses or errors.

• /hoteldruid/creaprezzi.php?numcaselle=
• numcaselle=
• SQL syntax error
• UNION SELECT

What your security team should do

• Apply the listed fixed package versions within the next 48 hours
• Scan all public-facing instances for the vulnerable endpoint
• Add web application firewall rules blocking common SQL metacharacters in numcaselle
• Review database accounts for least-privilege enforcement