CVE-2025-44203

In HotelDruid 3.0.7, an unauthenticated attacker can exploit verbose SQL error messages on creadb.php before the 'create database' button is pressed. By sending malformed POST requests to this endpoint, the attacker may obtain the administrator username, password hash, and salt. In some cases, th...

CVE-2025-44203

In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a race condition during which verbose SQL error messages...

CVE-2025-44203

HotelDruid 3.0.7 is affected. An unauthenticated attacker can trigger information disclosure by causing verbose SQL error messages in creadb.php before pressing the 'create database' button. Malformed POST requests to the endpoint may reveal administrator credentials: username, password hash, and...

CVE-2025-44203

creationtimestamp| type| source ---|---|--- 2025-06-18 19:07:34+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/40989 2025-06-19 03:00:07+00:00| published-proof-of-concept| Telegram/3DLF0Mv42zDQ9z6gIgLfJqznkdRPaQmP3DioJ9Oj28FPPS0 2025-06-19 03:00:09+00:00| published-proof-of-concept...

Exploit for Uncontrolled Resource Consumption in Digitaldruid Hoteldruid

CVE-2025-44203 HotelDruid 3.0.0 / 3.0.7 Sensitive Information...