CVE-2025-44203

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2025-44203

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-44203.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2025-44203

Downstream

UBUNTU-CVE-2025-44203

Published

2025-06-20T16:15:28Z

Modified

2025-07-01T16:31:55.979794Z

Summary

[none]

Details

In HotelDruid 3.0.7, an unauthenticated attacker can exploit verbose SQL error messages on creadb.php before the 'create database' button is pressed. By sending malformed POST requests to this endpoint, the attacker may obtain the administrator username, password hash, and salt. In some cases, the attack results in a Denial of Service (DoS), preventing the administrator from logging in even with the correct credentials.

References

Affected packages

Debian:11 / hoteldruid

Package

Name: hoteldruid
Purl: pkg:deb/debian/hoteldruid?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.1-1

3.0.3-1

3.0.4-1

3.0.5-1

3.0.6-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / hoteldruid