CVE-2023-34537

Deeper analysis

A reflected cross-site scripting vulnerability was discovered in HotelDruid version 3.0.5 and is tracked as CVE-2023-34537. The flaw, classified under CWE-79, allows an attacker to supply malicious code or commands via a vulnerable webpage parameter, resulting in a CVSS 3.1 score of 5.4.

An authenticated attacker with network access can craft a URL containing the malicious payload and deliver it to a victim user. When the victim interacts with the link, the injected script executes in the victim's browser under the affected site's origin, enabling actions such as data exfiltration or unauthorized commands within the reflected context.

The two provided references consist of GitHub repositories that document the discovery and proof-of-concept but contain no official advisories, vendor patches, or mitigation guidance. The EPSS score reached a peak of 0.1583 and currently stands at 0.1286, indicating moderate and relatively stable exploitation interest since disclosure.