How to fix CVE-2025-25748?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Is PHP affected by CVE-2025-25748?

Organizations using A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 face moderate risk from CVE-2025-25748, a cross-site request forgery vulnerability rated CVSS 7.3.

PHP CVE-2025-25748

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-03-11 [email protected]

PHP

7.3

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 19:52 vuln.today

CVE Published

Mar 11, 2025 - 18:15 nvd

HIGH 7.3

DescriptionNVD

A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords) on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disputed because there is an id_sessione CSRF token.

AnalysisAI

gestione_utenti.php endpoint of HotelDruid 3.0.7 is affected by cross-site request forgery (csrf) (CVSS 7.3).

Technical ContextAI

This vulnerability (CWE-352: Cross-Site Request Forgery (CSRF)) exists in the gestione_utenti.php component. A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords) on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disputed because there is an id_sessione CSRF token.

Affected ProductsAI

Product: gestione_utenti.php endpoint of HotelDruid 3.0.7. Component: gestione_utenti.php.

RemediationAI

Monitor vendor advisories for a patch.

CVE-2025-25748 vulnerability details – vuln.today

Back