CVE-2025-44203
📋 TL;DR
An unauthenticated attacker can exploit verbose SQL error messages in HotelDruid 3.0.7 to extract administrator credentials (username, password hash, and salt) via malformed POST requests to creadb.php. This vulnerability can also cause Denial of Service (DoS) by preventing legitimate administrator login. All users running HotelDruid 3.0.7 are affected.
💻 Affected Systems
- HotelDruid
📦 What is this software?
Hoteldruid by Digitaldruid
Hoteldruid by Digitaldruid
⚠️ Risk & Real-World Impact
Worst Case
Attacker obtains administrator credentials, gains full system access, and causes persistent DoS preventing legitimate administration.
Likely Case
Attacker extracts administrator password hash and salt for offline cracking, potentially leading to account compromise.
If Mitigated
Limited information disclosure with no authentication bypass if proper input validation and error handling are implemented.
🎯 Exploit Status
Exploit requires sending malformed POST requests to creadb.php endpoint; public proof-of-concept code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.hoteldruid.com/
Restart Required: No
Instructions:
Check vendor website for security updates; if unavailable, implement workarounds immediately.
🔧 Temporary Workarounds
Disable creadb.php endpoint
linuxRemove or restrict access to the vulnerable creadb.php file to prevent exploitation.
mv /path/to/hoteldruid/creadb.php /path/to/hoteldruid/creadb.php.disabled
Implement web application firewall rules
allBlock malformed POST requests to creadb.php endpoint using WAF rules.
🧯 If You Can't Patch
- Implement network segmentation to restrict access to HotelDruid instances
- Monitor for suspicious POST requests to creadb.php and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Send malformed POST request to /creadb.php and check for verbose SQL error messages containing credential information.Check Version:
Check HotelDruid version in admin interface or configuration files.Verify Fix Applied:
Verify creadb.php is inaccessible or properly handles errors without disclosing sensitive information.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to creadb.php with malformed parameters
- SQL error messages in application logs containing credential information
Network Indicators:
- Unusual POST traffic to creadb.php endpoint from unauthenticated sources
SIEM Query:
source="web_logs" AND uri="/creadb.php" AND method="POST" AND status=500