Executive brief
AMTT Hotel Broadband Operation System, a platform used to manage internet services in hospitality environments, contains a security flaw in its network management component. An attacker with administrative access can exploit this to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive guest information or system configuration data, potentially disrupting hotel operations.
Technical details
A SQL injection vulnerability exists in AMTT Hotel Broadband Operation System 1.0 within the 'manager/network/switch_status.php' file. The root cause is the improper neutralization of the 'id' GET parameter, which is passed directly into a SQL query without sufficient sanitization. An attacker with high privileges (authenticated as an administrator) can execute arbitrary SQL commands remotely. A proof-of-concept exploit using the 'updatexml' function has been disclosed, demonstrating the ability to extract database names and other sensitive information. As of the advisory date, the vendor has not responded to the disclosure, and no patch is currently available.
Affected products
- AMTT Hotel Broadband Operation System 1.0
Timeline
- 2026-06-01: disclosed: Initial disclosure on GitHub by researcher MichaelZhuang521
- 2026-07-12: advisory: CVE published and NVD record created