CVE-2025-44203

CVE-2025-44203: HotelDruid 3.0.0 / 3.0.7 Sensitive Information Disclosure and DoS Summary HotelDruid 3.0.0 and 3.0.7 contain a race condition on the creadb.php setup endpoint, reachable before the setup is finished. It has two impacts, and both come from the same lost race: a sensitive informatio...

📄 HotelDruid 3.0.x Credential Exposure / Stress Tester

Proof of concept denial of service and credential disclosure exploit for HotelDruid versions 3.0.0 and 3.0.7. ================================================================================================================================== | Title : HotelDruid 3.0.x Credential Exposure & Stress...

CVE-2025-44203: Generation of Error Message Containing Sensitive Information

In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a race condition during which verbose SQL error messages...

HotelDruid security vulnerability

Hoteldruid is a free and open source hotel management program from Hoteldruid, Inc. A security vulnerability exists in Hoteldruid version 3.0.7, which stems from the creadb.php endpoint displaying a detailed SQL error message, which could lead to an information disclosure or denial of service...