CVE-2026-54419: PIAF-HMS multiple unauthenticated SQL injection vulnerabilities via mysql_query

Synopsis

Multiple unauthenticated SQL injection vulnerabilities exist in claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System), a PHP hotel management application. The application passes user-supplied HTTP parameters directly into deprecated mysql_query() calls via string concatenation with no sanitization, escaping, or parameterization, and no authentication gate in front of any affected endpoint. A remote attacker with network access to the application can read, modify, or delete arbitrary records in the backing database across multiple endpoints. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoints are served over HTTP, so an attacker must be able to reach the application over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  The application has no authentication mechanism on any of the affected endpoints, so no credentials or session token of any kind are needed.

• Victim interactionNot required

  The attacker sends crafted HTTP requests directly to the server; no user action or social engineering is required.

• Attack complexityDetail

  Exploitation is reliable and condition-free: parameters are concatenated directly into SQL queries with no sanitization, making injection straightforward and repeatable without race conditions or special environmental setup.

Blast Radius

• Reads arbitrary records from the backing database, including guest reservations, room data, billing records, and extension mappings.
• Modifies persisted database rows, for example overwriting room rates, check-in records, or wake-up call entries.
• Deletes arbitrary database records, as demonstrated by the rooms.php?ID=1 OR 1=1 payload which removes all room rows in a single request.
• Note: the legacy mysql_* extension does not permit stacked statements, so execution of additional SQL commands beyond the injected query is constrained to the original statement type.