CVE-2021-37832: 
Linux Debian vulnerability analysis and mitigation

A SQL injection vulnerability was discovered in Hotel Druid version 3.0.2 when using SQLite as the application database. The vulnerability was identified in July 2021 and assigned CVE-2021-37832. The vulnerability affects the modifica_app.php page through the idappartamenti parameter, allowing malicious attackers to issue arbitrary SQL commands to the SQLite database (NVD, GitHub POC).

The vulnerability exists in the modificaapp.php file, specifically in the handling of the idappartamenti parameter. When SQLite is used as the application database, the parameter is not properly sanitized, allowing for SQL injection attacks. The vulnerability can be exploited using tools like sqlmap with the following payload pattern: sqlmap -u "/modificaapp.php?tipotabella=appartamenti&anno=2021&idsessione=&idappartamenti=01" --level=3 --risk=2 --banner --dbms=sqlite (GitHub POC).

The vulnerability allows attackers to execute arbitrary SQL commands against the SQLite database, potentially leading to unauthorized access to sensitive data, modification of database contents, or compromise of the application's functionality (NVD).

The vulnerability has been fixed in subsequent versions of Hotel Druid. Users should upgrade to a version newer than 3.0.2 to mitigate this vulnerability (Debian Tracker).