CVE-2023-43374

What it actually does

Unauthenticated SQL injection via the id_utente_log parameter in personalizza.php allows arbitrary SQL execution against the backend database, enabling data exfiltration, modification, or deletion.

Why it matters to the business

Attackers can steal or alter sensitive guest, reservation, and financial records, leading to regulatory penalties, loss of customer trust, and operational disruption in hospitality environments; prevalence across Debian-packaged deployments increases exposure surface.

How an attack unfolds

An attacker sends a crafted HTTP request containing malicious SQL in the id_utente_log parameter to /hoteldruid/personalizza.php; the unsanitized input is concatenated into a query that executes directly, returning database contents or allowing further commands; weaponized exploits facilitate rapid compromise without authentication.

How to fix it

Upgrade affected packages to the listed fixed versions: thunderbird on Debian 11/12/13 to 1:115.7.0-1~deb11u1 / 1:115.7.0-1~deb12u1 / 1:115.7.0-1 and firefox-esr on Debian 11/12/13 to 115.7.0esr-1~deb11u1 / 115.7.0esr-1~deb12u1 / 115.7.0esr-1; apply vendor patches for Hoteldruid 3.0.5 or later and sanitize all inputs.

How to confirm the fix worked

Confirm package versions match the fixed releases above using apt or dpkg; retest the personalizza.php endpoint with benign input to verify query parameterization; review application logs for prior anomalous queries.

Typical attack path

1. Identify publicly reachable Hoteldruid instance
2. Send crafted request with SQL payload in id_utente_log parameter
3. Extract or modify database contents
4. Escalate to persistent access or lateral movement using obtained credentials

How to detect it

Search web server and application logs for requests to personalizza.php containing unusual characters or SQL keywords in the id_utente_log parameter; review database query logs for unexpected unions, selects, or error patterns; correlate with Debian package version history.

• /hoteldruid/personalizza.php?id_utente_log=
• SQL syntax error in personalizza.php logs
• UNION SELECT in id_utente_log values

What your security team should do

• Immediately apply the listed Debian package upgrades for thunderbird and firefox-esr
• Patch or replace Hoteldruid installations with versions containing input sanitization
• Monitor EPSS trend and enable virtual patching via WAF rules until upgrades complete
• Audit database access logs for the last 1122 days for suspicious id_utente_log activity