CVE-2019-9084

Severity: medium (CVSS 4.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-06-07 · updated 2026-06-17
Weakness: CWE-369

Description

In Hoteldruid before 2.3.1, a division by zero was discovered in $num_tabelle in tab_tariffe.php (aka the numtariffa1 parameter) due to the mishandling of non-numeric values, as demonstrated by the /tab_tariffe.php?anno=[YEAR]&numtariffa1=1a URI. It could allow an administrator to conduct remote denial of service (disrupting certain business functions of the product).

Affected products

DigitalDruid.Net HOTELDRUID: before 2.3.1 — fixed in 2.3.1

How to fix

Upgrade to a fixed version: DigitalDruid.Net HOTELDRUID 2.3.1. Check the vendor advisory for mitigations.

References

http://www.hoteldruid.com/en/download.html
https://metamorfosec.com/Files/Advisories/METS-2019-005-A_division_by_zero_in_Hoteldruid_before_v2.3.1.txt
http://www.hoteldruid.com/en/download.html
https://metamorfosec.com/Files/Advisories/METS-2019-005-A_division_by_zero_in_Hoteldruid_before_v2.3.1.txt

Get alerted when CVE-2019-9084 or the next vulnerability affects your stack