Hoteldruid CVE-2025-44203

This vulnerability presents significant real-world risk despite a moderate-seeming CVSS score of 7.5. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates network-accessible, low-complexity exploitation requiring no privileges or user interaction, but the vector underweights the information disclosure impact. The actual risk is amplified by: (1) unauthenticated access—attackers need no credentials, (2) credential exposure—leaked password hashes and salts enable offline brute-force or rainbow-table attacks, (3) automatable exploitation—malformed POST requests are trivial to craft, (4) high deployment likelihood—HotelDruid is actively used in hospitality sectors, and (5) DoS impact—system lockout prevents legitimate administrative access. The CVSS vector's 'C:N' (no confidentiality impact) misrepresents the severity, as password hashes and salts are high-value information assets. Real-world exploitation probability is high given the simplicity of the attack and the widespread scanning of publicly exposed HotelDruid instances. This should be treated as a critical priority for any HotelDruid deployment.

An attacker discovers a HotelDruid 3.0.7 instance deployed on a public web server (e.g., hotel-example.com/hoteldruid/). The attacker sends a malformed POST request to /hoteldruid/creadb.php with invalid SQL parameters or database connection strings. The vulnerable script processes the request without sanitizing input and triggers a database error, returning a verbose SQL error message to the attacker. This error message contains the database configuration, including the administrator username (e.g., 'admin'), password hash (e.g., MD5 or bcrypt hash), and salt value. With these credentials, the attacker performs an offline brute-force attack using a password cracking tool (hashcat, John the Ripper) to recover the plaintext password. Once credentials are obtained, the attacker logs into the HotelDruid admin panel to access guest data, reservations, and payment information. Alternatively, if the attacker sends a specially crafted request that corrupts the database initialization state, the legitimate administrator cannot log in with correct credentials, resulting in a denial of service that requires manual database repair or reinstallation. This attack requires no special tools beyond curl or a web browser, no authentication, and can be automated to scan large numbers of HotelDruid instances.