CVE-2023-43376

What it actually does

Unsanitized user input in the nometipotariffa1 parameter of /hoteldruid/clienti.php is reflected back into HTML responses, enabling execution of attacker-supplied JavaScript in the context of other users' browsers.

Why it matters to the business

Attackers can steal session tokens, perform actions on behalf of authenticated users, or deface pages within hotel management portals, leading to data exposure, operational disruption, and loss of customer trust.

How an attack unfolds

An attacker crafts a malicious payload containing script tags or event handlers, appends it to the nometipotariffa1 parameter, and causes a victim to load the affected page; the browser then executes the injected code with the privileges of the logged-in user.

How to fix it

Apply output encoding and input validation to all parameters rendered in clienti.php; implement a strict Content-Security-Policy; monitor vendor releases for a patched version of Hoteldruid and upgrade immediately when available.

How to confirm the fix worked

Submit known XSS test vectors to the nometipotariffa1 parameter and confirm that scripts are blocked rather than executed; review rendered HTML source for absence of unencoded input.

Typical attack path

1. Locate the clienti.php endpoint and identify the nometipotariffa1 parameter
2. Craft and encode a JavaScript payload that performs desired actions such as cookie exfiltration
3. Deliver the payload via a crafted URL or form submission
4. Induce a target user to visit the malicious link while authenticated
5. Execute actions in the victim's browser session

How to detect it

Inspect web server access logs for requests to clienti.php containing the nometipotariffa1 parameter with HTML or JavaScript syntax; correlate with successful responses and subsequent suspicious activity from the same session.

• nometipotariffa1=
• <script
• onerror=
• javascript:
• /hoteldruid/clienti.php

What your security team should do

• Prioritize patching or implementing server-side sanitization within 30 days given public exploit availability
• Deploy a web application firewall rule to block common XSS patterns targeting clienti.php
• Enable Content-Security-Policy headers to limit script execution sources
• Review access logs for anomalous nometipotariffa1 values containing script or event-handler syntax