The vulnerability is a classic SQL injection flaw that allows an unauthenticated attacker to send crafted HTTP parameters directly to mysql_query functions. By exploiting these weaknesses the attacker can execute arbitrary SQL statements against the back‑end database, which can lead to unauthorized reading, modification, or deletion of database records, and potentially full compromise of the application’s data integrity and confidentiality.

The application affected is PIAF‑HMS, developed by claudiopizzillo. No official releases exist; the latest code is committed to the repository at commit 389d2633441b65ced1c104212cd62be2bfca21e5. The system has no authentication mechanism, and the vulnerable PHP scripts include rooms.php, checkuser.php, ec.php, checkin.php, wakeup.php, bills.php, rates.php, and checkout.php.

The CVSS score of 9.3 reflects the high severity of this flaw, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via a simple HTTP GET or POST request to any of the vulnerable endpoints, without needing credentials or prior access. Because the application permits unauthenticated requests and the vulnerability is content‑injection based on user input, the exploit is straightforward and highly likely to be used if discovered.