CVE-2023-43375

What it actually does

Unauthenticated SQL injection in multiple parameters of /hoteldruid/clienti.php allowing arbitrary database read, write, or delete operations due to unsanitized input.

Why it matters to the business

Attackers can extract or manipulate hotel customer and reservation records, causing data breaches, regulatory penalties, loss of customer trust, and potential service outages.

How an attack unfolds

An attacker sends crafted HTTP GET requests to the clienti.php endpoint embedding SQL payloads in the annonascita, annoscaddoc, giornonascita, giornoscaddoc, lingua_cli, mesenascita, or mesescaddoc parameters; the application concatenates these values directly into SQL statements, enabling execution of attacker-controlled queries.

How to fix it

Upgrade Hoteldruid to a patched release that uses parameterized queries or proper escaping for the affected parameters; apply the listed Firefox fixes only if that unrelated component is also present in the environment.

How to confirm the fix worked

Re-test the seven parameters with benign SQL injection probes and confirm that error-based or boolean-based responses no longer appear; verify application logs show no unescaped user input reaching the database layer.

Typical attack path

1. Locate publicly reachable Hoteldruid instance running version 3.0.5 or earlier
2. Submit requests containing SQL metacharacters and payloads to the listed parameters
3. Observe database error messages or infer success from application behavior
4. Extract schema and data or perform destructive operations via injected queries

How to detect it

Inspect web server access logs for requests to clienti.php containing the listed parameters; search for SQL keywords, quotes, or comment characters in those parameter values and correlate with database error logs or unexpected query volumes.

• /hoteldruid/clienti.php?annonascita=
• /hoteldruid/clienti.php?giornonascita=
• OR '1'='1
• UNION SELECT
• mesenascita=
• mesescaddoc=

What your security team should do

• Immediately restrict public access to /hoteldruid/clienti.php until patched
• Deploy web application firewall rules to block common SQL metacharacters in the named parameters
• Upgrade to the corrected Hoteldruid version and retest within the next 30 days given rising EPSS trend
• Add the endpoint to routine vulnerability scanning and log review