EUVD-2026-37872
GHSA-733h-q99j-37gc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Application ships with no authentication and parameters reach SQL sinks over HTTP with no user interaction, giving full read/write/delete on the database, hence AV:N/AC:L/PR:N/UI:N and C/I/A:H.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
6DescriptionCVE.org
claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query() calls via string concatenation, without sanitization, escaping, or parameterization. Affected sinks include rooms.php (DELETE FROM Rooms WHERE ID = $_GET['ID'], unquoted numeric context), checkuser.php (WHERE Ext = '$_GET["Ext"]'), ec.php (date/extension parameters in a WHERE), checkin.php and wakeup.php ($_POST values into INSERT statements), bills.php ($_POST fields built into a WHERE clause), and rates.php and checkout.php. A remote, unauthenticated attacker can inject arbitrary SQL to read, modify, or delete arbitrary records in the backing database (e.g. rooms.php?ID=1 OR 1=1 deletes all room records). Note: queries run via the legacy mysql_* extension, which does not permit stacked statements.
Articles & Coverage 1
AnalysisAI
Unauthenticated SQL injection in claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System) lets remote attackers read, modify, or delete arbitrary database records by tampering with HTTP parameters that are concatenated into legacy mysql_query() calls. The project ships with no authentication mechanism and no released versions, so any deployment exposing it to the network is fully compromisable; no public exploit identified at time of analysis, though CISA SSVC rates the technical impact as total and automatable.
Technical ContextAI
PIAF-HMS is a PHP-based hotel management front-end bundled with PBX-In-A-Flash telephony stacks, using the long-deprecated ext/mysql interface (removed in PHP 7) to talk to a MySQL backend. The flaws are textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), arising because user-controlled values from $_GET and $_POST are spliced into SQL strings without prepared statements, mysql_real_escape_string, or input validation. Vulnerable sinks span numeric (unquoted) DELETE contexts in rooms.php and quoted string contexts in checkuser.php, ec.php, checkin.php, wakeup.php, bills.php, rates.php, and checkout.php. One mitigating quirk of the legacy mysql_* extension is that it does not allow stacked statements, so single-query payloads (UNION SELECT, boolean/time-based blind, or destructive single-statement updates) are the practical primitives rather than chained multi-statement attacks.
RemediationAI
No vendor-released patch identified at time of analysis - the project has no tagged releases and no fix commits referenced in the advisory. Operators should remove PIAF-HMS from any internet-facing network immediately and, if it must remain reachable, place it behind an authenticating reverse proxy (Apache/nginx basic auth or an SSO gateway) restricted to trusted LAN/VPN addresses to compensate for the missing application-layer auth; note this only blocks unauthenticated abuse and does not fix the underlying injection. A WAF rule set blocking SQL metacharacters in the named parameters (ID, Ext, date, extension, and the POST bodies of checkin/wakeup/bills) can blunt automated tooling like sqlmap but will produce false positives on legitimate alphanumeric room and extension data. The durable fix requires forking the project to replace every mysql_query() call with mysqli/PDO prepared statements and bound parameters, casting numeric inputs to (int), and adding authentication before the affected endpoints; track upstream at https://github.com/claudiopizzillo/PIAF-HMS and the specific sinks at https://github.com/claudiopizzillo/PIAF-HMS/blob/389d2633441b65ced1c104212cd62be2bfca21e5/rooms.php#L16 and https://github.com/claudiopizzillo/PIAF-HMS/blob/389d2633441b65ced1c104212cd62be2bfca21e5/ec.php#L57 for the canonical vulnerable patterns.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today