CVE-2023-33817
Published: 13 June 2023
Summary
CVE-2023-33817 is a high-severity SQL Injection (CWE-89) vulnerability in Digitaldruid Hoteldruid. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 6.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-33817 is a SQL injection vulnerability, tracked under CWE-89, that affects HotelDruid version 3.0.5. The flaw carries a CVSS 3.1 base score of 8.8 with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating remote network access with low attack complexity and low required privileges.
An authenticated attacker can supply crafted input to trigger the injection, enabling arbitrary SQL commands that may read, modify, or delete database contents and potentially lead to full compromise of the affected application instance.
Public references consist of GitHub repositories that document the discovery and proof-of-concept details for the issue in HotelDruid 3.0.5; no official vendor advisory or patch information is provided in the available sources. The associated EPSS score has remained flat at a peak and current value of 0.1210, indicating no material rise in observed exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-37968
Vulnerability details
hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.