In HotelDruid 3.0.0 and 3.0.7, the unauthenticated endpoint creadb.php used during database setup can be accessed before setup completion. An attacker can exploit a race condition by sending multiple concurrent requests, which causes verbose SQL error messages to leak the administrator username, password hash, and salt. This race condition also leaves the setup in a partially initialized state, preventing administrator login with the installation credentials and causing a denial of service that necessitates reinstallation. Remote exploitation requires the installation to permit non-localhost access. The vulnerability is resolved in version 3.0.8.

The vulnerability allows an unauthenticated attacker to obtain sensitive administrator credentials through error message disclosure and causes a denial of service by corrupting the setup state, preventing administrator login. This can disrupt service availability and compromise credential confidentiality. Remote exploitation is limited to installations that allow non-localhost access to the setup endpoint.

Upgrade HotelDruid to version 3.0.8 or later, where this vulnerability is fixed. Until then, restrict access to the database setup endpoint to localhost only to prevent remote exploitation. Patch status is confirmed fixed in 3.0.8.