CVE-2025-25748

Published Mar 11, 2025

Last updated 14 days ago

CVSS high 7.3

Overview

Description
A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords) on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disputed because there is an id_sessione CSRF token.
Source
cve@mitre.org
NVD status
Undergoing Analysis
CNA Tags
disputed

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.3
Impact score
5.5
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Severity
HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-352

Social media

Hype score
Not currently trending

  1. CVE-2025-25748 A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords) on beha… https://t.co/0n4CRrZ5VF

    @CVEnew

    11 Mar 2025

    225 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

References