CVE-2025-25748

Summary

CVE-2025-25748 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the HotelDruid 3.0.7 software. Attackers can exploit this weakness in the gestione_utenti.php endpoint, taking advantage of the absence of origin or referrer validation and CSRF tokens. This vulnerability allows unauthorized actions, such as modifying user passwords, to be carried out on behalf of authenticated users. However, it is disputed that this vulnerability exists due to the presence of an id_sessione CSRF token, which should ideally prevent such attacks. Nevertheless, it's essential to ensure that proper CSRF protection measures, such as using CSRF tokens and input validation, are in place to mitigate potential risks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.