Vulnerability · Published Jun 20, 2025 · Assigned by mitre
CVE-2025-44203
High 7.5
In plain English
A high-severity uncontrolled resource consumption in the hoteldruid package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a race condition during which verbose SQL error messages disclose the administrator username, password hash, and salt. The same race leaves the setup partially initialized, so the administrator can no longer log in with the credentials set during installation, resulting in a denial of service that requires reinstallation to recover. Remote exploitation additionally requires the installation to allow non-localhost access. The vulnerability was fixed in version 3.0.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | hoteldruid | no fix listed | DEBIAN-CVE-2025-44203 |
| Ubuntu:22.04:LTS | hoteldruid | no fix listed | UBUNTU-CVE-2025-44203 |
| Ubuntu:24.04:LTS | hoteldruid | no fix listed | UBUNTU-CVE-2025-44203 |
| Ubuntu:25.10 | hoteldruid | no fix listed | UBUNTU-CVE-2025-44203 |
Affected products (as reported)
Weakness: CWE-209, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H