CVE-2026-54419

Name of the Vulnerable Software and Affected Versions PIAF-HMS (affected versions not specified)

Description PIAF-HMS contains multiple unauthenticated SQL injection issues. The application lacks an authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql query() calls using string concatenation without sanitization, escaping, or parameterization. A remote, unauthenticated attacker can inject arbitrary SQL to read, modify, or delete records in the database. Affected endpoints include 'rooms.php' (via the ID parameter), 'checkuser.php' (via the Ext parameter), 'ec.php' (via date and extension parameters), 'checkin.php' and 'wakeup.php' (via $ POST values), 'bills.php' (via $ POST fields), 'rates.php', and 'checkout.php'. The system uses the legacy mysql * extension, which does not support stacked statements.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.