CVE-2025-44203

View on CVE.org
Published Jun 20, 2025 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a race condition during which verbose SQL error messages disclose the administrator username, password hash, and salt. The same race leaves the setup partially initialized, so the administrator can no longer log in with the credentials set during installation, resulting in a denial of service that requires reinstallation to recover. Remote exploitation additionally requires the installation to allow non-localhost access. The vulnerability was fixed in version 3.0.8.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-18763 In HotelDruid 3.0.7, an unauthenticated attacker can exploit verbose SQL error messages on creadb.php before the 'create database' button is pressed. By sending malformed POST requests to this endpoint, the attacker may obtain the administrator username, password hash, and salt. In some cases, the attack results in a Denial of Service (DoS), preventing the administrator from logging in even with the correct credentials.
History
Type Values Removed Values Added
Description In HotelDruid 3.0.7, an unauthenticated attacker can exploit verbose SQL error messages on creadb.php before the 'create database' button is pressed. By sending malformed POST requests to this endpoint, the attacker may obtain the administrator username, password hash, and salt. In some cases, the attack results in a Denial of Service (DoS), preventing the administrator from logging in even with the correct credentials. In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a race condition during which verbose SQL error messages disclose the administrator username, password hash, and salt. The same race leaves the setup partially initialized, so the administrator can no longer log in with the credentials set during installation, resulting in a denial of service that requires reinstallation to recover. Remote exploitation additionally requires the installation to allow non-localhost access. The vulnerability was fixed in version 3.0.8.
Type Values Removed Values Added
Metrics epss

{'score': 0.00053}

 epss

{'score': 0.00024}
Type Values Removed Values Added
First Time appeared Digitaldruid
Digitaldruid hoteldruid
CPEs cpe:2.3:a:digitaldruid:hoteldruid:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:digitaldruid:hoteldruid:3.0.7:*:*:*:*:*:*:*
Vendors & Products Digitaldruid
Digitaldruid hoteldruid
Type Values Removed Values Added
Weaknesses CWE-209
CWE-400
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description In HotelDruid 3.0.7, an unauthenticated attacker can exploit verbose SQL error messages on creadb.php before the 'create database' button is pressed. By sending malformed POST requests to this endpoint, the attacker may obtain the administrator username, password hash, and salt. In some cases, the attack results in a Denial of Service (DoS), preventing the administrator from logging in even with the correct credentials.
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Jul 9, 2026, 1:55 PM
Reserved
Apr 22, 2025, 12:00 AM

View source JSON

Updated
Jun 24, 2025, 1:49 PM

JSON

Status
Modified
Published
Jun 20, 2025, 4:15 PM
Modified
Jul 9, 2026, 3:16 PM

View source JSON

No data.

Updated
Jun 23, 2025, 8:20 AM

JSON