CVE-2021-38559: 
Linux Debian vulnerability analysis and mitigation

DigitalDruid HotelDruid 3.0.2 was discovered to contain a cross-site scripting (XSS) vulnerability in prenota.php affecting the fineperiodo1 parameter. The vulnerability was assigned CVE-2021-38559 and was fixed in version 3.0.3 released on August 20, 2021 (HotelDruid Website, NVD).

The vulnerability is a reflected cross-site scripting (XSS) issue that occurs when special characters are inserted into the fineperiodo1 parameter of the prenota.php endpoint. The application fails to properly sanitize user input, allowing attackers to inject and execute malicious JavaScript code in the user's browser context. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browsers. This can lead to theft of credentials, session tokens, and other sensitive information stored in the browser. Additionally, attackers can manipulate the page content to display phishing forms or malicious content that appears to come from the legitimate site (Vitthal's Writeup).

The vulnerability has been fixed in HotelDruid version 3.0.3, released on August 20, 2021. Users are advised to upgrade to this or a later version to mitigate the risk (HotelDruid Website).