PT-2025-10458 · Unknown+1 · Hoteldruid+1

Huy Vo · Publicado 2025-03-07 · Atualizado 2026-01-29 · CVE-2025-25748

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions: HotelDruid version 3.0.7

Description: A CSRF issue in the "gestione utenti.php" endpoint allows attackers to perform unauthorized actions, such as modifying user passwords, on behalf of authenticated users. This is due to the lack of origin or referrer validation and the absence of CSRF tokens.

Recommendations: For HotelDruid version 3.0.7, consider implementing origin or referrer validation and adding CSRF tokens to the "gestione utenti.php" endpoint to prevent unauthorized actions. As a temporary workaround, restrict access to the "gestione utenti.php" endpoint to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2025-25748

Produtos afetados

Debian

Hoteldruid

Referências · 13

• https://ubuntu.com/security/CVE-2025-25748 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2025-25748 · Nota de Segurança
• https://twitter.com/CVEnew/status/1899518286645383478 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1898130057022898188 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-25748 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1898127496878444696 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-25748 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1898132616982745250 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2025-25748 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-25748 · Aviso do Fabricante
• https://t.me/cveNotify/150326 · Publicação no Telegram
• https://huyvo.net/post/cve-2025-25748-cross-site-request-forgery-csrf-vulnerability-in-hoteldruid-3-0-7 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-25748 · Aviso do Fabricante