CVE Intelligence
Analysis AI-assisted

CVE-2026-54419: PIAF-HMS (PBX-In-A-Flash Hotel Management System): multiple unauthenticated SQL injections

CVE-2026-54419 describes multiple unauthenticated SQL injection flaws in claudiopizzillo PIAF-HMS, a hotel management add-on for PBX-In-A-Flash. The application has no authentication and concatenates HTTP parameters directly into deprecated mysql_query calls. The CNA rates it critical (CVSS 3.1 score 9.8), and no fixed release is identified in the sources.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-54419 covers multiple SQL injection vulnerabilities (CWE-89) in PIAF-HMS, the PBX-In-A-Flash Hotel Management System published by claudiopizzillo on GitHub. According to the record, the application has no authentication mechanism at all. It builds database queries by concatenating user-supplied HTTP parameters into deprecated mysql_query calls, with no sanitization, escaping or parameterized queries. The record references code locations in rooms.php and ec.php.

Impact

The CNA assigns a CVSS 3.1 base score of 9.8 (critical) with vector AV:N/AC:L/PR:N/UI:N, and also a CVSS 4.0 score of 9.3. The vector indicates network reachability, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. In practice, anyone who can reach the web interface could potentially read, modify or delete data in the backing MySQL database, which in a hotel context may include guest and room information. Depending on database privileges and configuration, impact could extend further into the PBX environment; this is an inference, not stated in the sources.

Affected products and versions

  • Product: claudiopizzillo PIAF-HMS
  • The project has no released versions; the record identifies the latest commit as 389d2633441b65ced1c104212cd62be2bfca21e5.
  • No structured affected-version ranges are listed. Any deployment based on this code should be treated as affected unless proven otherwise.

Exploitation status

The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record. Because the flaws require no authentication and the source code is public, the barrier to abuse is low.

Remediation and mitigation

The record lists no fixed version or patch. A missing fix in the data does not prove none exists, but defenders should not assume one will arrive.

  • Remove PIAF-HMS from any internet-facing or untrusted network exposure immediately.
  • If the system must remain in use, restrict access to trusted administrative hosts via firewall rules, VPN or reverse-proxy authentication.
  • Run the application's database account with the minimum privileges needed, and isolate it from other databases on the same server.
  • Organizations maintaining their own fork should replace string-concatenated queries with parameterized queries (for example via mysqli or PDO prepared statements) and add an authentication layer.
  • Consider migrating to an actively maintained hotel/PBX management solution.
  • A web application firewall may reduce risk temporarily but is not a substitute for fixing the code.

Detection guidance

  • Inventory PBX-In-A-Flash systems and check whether PIAF-HMS files (such as rooms.php and ec.php) are deployed and reachable.
  • Review web server access logs for unusual parameter values, SQL syntax characters or abnormally long query strings sent to these scripts.
  • Monitor MySQL logs for query errors, unexpected UNION-style or schema-enumeration activity, and changes to data outside normal workflows.
  • Look for unexpected new accounts, altered records or files written by the database service.

Limitations of the available information

The NVD status for this record is Deferred, and the record contains no affected-version ranges, fix information, EPSS or SSVC data. The full list of vulnerable parameters and scripts is not enumerated beyond the two referenced code locations. Whether the project is maintained or will receive a fix is unknown.

Frequently asked questions

What is CVE-2026-54419?

It is a set of unauthenticated SQL injection vulnerabilities in claudiopizzillo PIAF-HMS, caused by concatenating HTTP parameters into mysql_query calls without sanitization or parameterization.

How severe is it?

The CNA rates it critical, with a CVSS 3.1 score of 9.8 and a CVSS 4.0 score of 9.3.

Is it being exploited?

It is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Is there a patch?

The record lists no fixed version or patch. Restrict network access, apply least-privilege database settings, and consider fixing the code in a fork or migrating to a maintained product.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.