PT-2025-10458 · Unknown+1 · Hoteldruid+1

Huy Vo · Published 2025-03-07 · Updated 2026-01-29 · CVE-2025-25748

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions: HotelDruid version 3.0.7

Description: A CSRF issue in the "gestione utenti.php" endpoint allows attackers to perform unauthorized actions, such as modifying user passwords, on behalf of authenticated users. This is due to the lack of origin or referrer validation and the absence of CSRF tokens.

Recommendations: For HotelDruid version 3.0.7, consider implementing origin or referrer validation and adding CSRF tokens to the "gestione utenti.php" endpoint to prevent unauthorized actions. As a temporary workaround, restrict access to the "gestione utenti.php" endpoint to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-25748

Affected Products

Debian

Hoteldruid

References · 13

• https://ubuntu.com/security/CVE-2025-25748 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-25748 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-25748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25748 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-25748 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-25748 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-25748 · Vendor Advisory
• https://twitter.com/CVEnew/status/1899518286645383478 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1898130057022898188 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1898127496878444696 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1898132616982745250 · Twitter Post
• https://t.me/cveNotify/150326 · Telegram Post
• https://huyvo.net/post/cve-2025-25748-cross-site-request-forgery-csrf-vulnerability-in-hoteldruid-3-0-7 · Note