In HotelDruid 3.0.0 and 3.0.7, the unauthenticated endpoint creadb.php used during database setup can be accessed before setup completion. By sending many concurrent requests, an attacker can trigger a race condition that causes verbose SQL error messages to leak the administrator username, password hash, and salt. Additionally, the race condition leaves the setup partially initialized, causing a denial of service by preventing administrator login with the installation credentials. Remote exploitation requires that the installation allows access from non-localhost sources. This vulnerability was fixed in version 3.0.8.

The vulnerability allows an unauthenticated attacker to obtain sensitive administrator credentials through SQL error message disclosure. It also causes a denial of service by corrupting the setup state, preventing administrator login and requiring reinstallation to recover. Remote exploitation is limited to installations allowing non-localhost access. There are no known exploits in the wild.

Upgrade HotelDruid to version 3.0.8 or later, where this vulnerability is fixed. Until then, restrict access to the setup endpoint to localhost only and avoid exposing the setup interface remotely. Patch status is confirmed fixed in 3.0.8.