HotelDruid CVE-2025-55816

Exploitation targets the /modifica_app.php endpoint of HotelDruid v3.0.7 and earlier, where user-supplied input is reflected without sanitization. The decisive limiting factor is required user interaction (UI:R): a victim - most plausibly a logged-in HotelDruid operator - must open an attacker-crafted link or submit attacker-influenced input for the payload to execute. No special non-default configuration is documented as a prerequisite. A key unresolved condition is authentication: the CVSS vector claims PR:N (no privileges), but because modifica_app.php is a modify/management script, reachability of the sink without a valid session should be verified; if authentication is in fact required, realistic risk drops further.

This is a reflected/stored Cross-Site Scripting flaw (CWE-79) rated CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - network-reachable, low complexity, no privileges, but requiring user interaction, with limited confidentiality/integrity impact and a changed scope (impact lands in the victim's browser context). Real-world risk signals are consistently moderate-to-low: EPSS is only 0.27% (18th percentile), the CVE is NOT in CISA KEV, and exploitation status is that publicly available exploit code exists (a write-up/PoC at partywave.site) rather than confirmed active exploitation. The signals are coherent rather than conflicting - a Medium-severity XSS with a public PoC but no evidence of in-the-wild abuse. The UI:R requirement and the client-side nature of XSS mean this is not a mass-exploitable server-compromise bug; it is a credible issue for targeted phishing/session-theft against HotelDruid users but not a drop-everything priority. One caveat to verify: the CVSS vector asserts PR:N (unauthenticated), yet /modifica_app.php appears to be a management/modify endpoint that may sit behind authentication - confirm with the vendor whether the vulnerable parameter is reachable pre-authentication.

An attacker crafts a malicious URL or input targeting the vulnerable parameter in /modifica_app.php and lures an authenticated HotelDruid operator into clicking it (UI:R). When the page reflects the unsanitized input, attacker-controlled JavaScript executes in the victim's browser session, enabling session cookie theft, UI defacement, or actions performed as the victim. Public exploit code/PoC for this XSS is available, lowering the barrier to weaponization.