5 matches found
CVE-2025-44203
In HotelDruid 3.0.7, an unauthenticated attacker can exploit verbose SQL error messages on creadb.php before the 'create database' button is pressed. By sending malformed POST requests to this endpoint, the attacker may obtain the administrator username, password hash, and salt. In some cases, th...
CVE-2025-44203
In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a race condition during which verbose SQL error messages...
CVE-2025-44203
HotelDruid versions 3.0.0 and 3.0.7 are vulnerable to a race condition on the unauthenticated creadb.php endpoint during database setup. Because the routine performs database creation without locking, an attacker sending concurrent POST requests can trigger verbose SQL error messages that disclos...
CVE-2025-44203
creationtimestamp| type| source ---|---|--- 2025-06-18 19:07:34+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/40989 2025-06-19 03:00:07+00:00| published-proof-of-concept| Telegram/3DLF0Mv42zDQ9z6gIgLfJqznkdRPaQmP3DioJ9Oj28FPPS0 2025-06-19 03:00:09+00:00| published-proof-of-concept...
