CSRF Vulnerability in HotelDruid Product by Vendor
CVE-2025-25748
7.3HIGH
Key Information:
- Vendor
Vendor
- Status
- Vendor
- CVE Published:
- 11 March 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-25748?
A critical CSRF vulnerability has been discovered in the gestione_utenti.php endpoint of HotelDruid 3.0.7. This flaw permits attackers to carry out unauthorized actions, such as altering user passwords, by taking advantage of inadequate validation of origination or referral headers and the lack of CSRF tokens. As a result, authenticated users may unknowingly facilitate actions that compromise the integrity of their accounts, highlighting the urgent need for proper security measures.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.