Eshmirzayev Abbos

**Name of the Vulnerable Software and Affected Versions** PIAF-HMS (affected versions not specified) **Description** PIAF-HMS contains multiple unauthenticated SQL injection issues. The application lacks an authentication mechanism and passes user-supplied HTTP parameters directly into deprecated `mysql query()` calls using string concatenation without sanitization, escaping, or parameterization. A remote, unauthenticated attacker can inject arbitrary SQL to read, modify, or delete records in the database. Affected endpoints include 'rooms.php' (via the `ID` parameter), 'checkuser.php' (via the `Ext` parameter), 'ec.php' (via date and extension parameters), 'checkin.php' and 'wakeup.php' (via `$ POST` values), 'bills.php' (via `$ POST` fields), 'rates.php', and 'checkout.php'. The system uses the legacy mysql * extension, which does not support stacked statements. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.