Executive brief
PIAF-HMS is a management system for hotel phone systems. The software contains multiple security flaws that allow anyone with network access to the system to view, change, or delete hotel records, such as room information and billing data, without needing a password. This could lead to significant operational disruption, loss of customer billing information, and unauthorized access to guest records.
Technical details
PIAF-HMS (latest commit 389d263) contains multiple SQL injection vulnerabilities due to the lack of an authentication mechanism and the use of deprecated mysql_query() calls that concatenate unsanitized user input directly into SQL statements. Vulnerable endpoints include rooms.php, checkuser.php, ec.php, checkin.php, wakeup.php, and bills.php, which process $_GET and $_POST parameters without escaping or parameterization. A remote, unauthenticated attacker can exploit these sinks to execute arbitrary SQL commands to manipulate the backing database. While the legacy mysql extension does not support stacked queries, attackers can still perform data exfiltration and record deletion (e.g., using 'OR 1=1' logic). No official patch or released version exists; users are advised to avoid deploying this software in production.
Affected products
- claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System) latest commit 389d2633441b65ced1c104212cd62be2bfca21e5
Timeline
- 2026-06-18: advisory: CVE published by NVD/TuranSec