Description (CNA)
claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query calls via string concatenation, without sanitization, escaping, or parameterization.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| claudiopizzillo / PIAF-HMS | affected 0 |
CWE
CWE-89
References
- https://github.com/claudiopizzillo/PIAF-HMS/blob/389d2633441b65ced1c104212cd62be2bfca21e5/rooms.php#L16
- https://github.com/claudiopizzillo/PIAF-HMS/blob/389d2633441b65ced1c104212cd62be2bfca21e5/ec.php#L57
- https://github.com/claudiopizzillo/PIAF-HMS
ADP enrichment
No English description supplied.
No references supplied.