CVE-2022-22909: 
Linux Debian vulnerability analysis and mitigation

HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module. The vulnerability was disclosed on March 2, 2022, and affects HotelDruid version 3.0.3 (NVD, Debian Tracker).

The vulnerability occurs because room names are stored inside a file named /dati/selectappartamenti.php using Double Quotes, allowing for PHP code injection. The vulnerability has a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that it can be exploited remotely with low attack complexity and requires low privileges (NVD).

A successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the server, potentially leading to complete system compromise. The attacker could gain the ability to read, modify, or delete data, install malware, or use the server for further attacks (Github POC).

The vulnerability has been fixed in versions after 3.0.3. Users are advised to upgrade to the latest version of HotelDruid. As of November 2024, the latest version available is 3.0.7 (HotelDruid).