The flaw is a classic SQL injection that allows an attacker to inject arbitrary SQL through user‑supplied HTTP parameters. The application passes these parameters straight into deprecated mysql_query calls without any sanitization or escaping. Successful exploitation can let the attacker execute any SQL statement—reading, modifying, or deleting database contents—and could ultimately lead to full compromise of the application’s data integrity and confidentiality.

The vulnerable software is the PBX‑In‑A‑Flash Hotel Management System (PIAF‑HMS), developed by claudiopizzillo. No official releases are available; the latest publicly available code resides at commit 389d2633441b65ced1c104212cd62be2bfca21e5. The entries at ec.php line 57 and rooms.php line 16 contain the vulnerable mysql_query calls, and the system provides no authentication, exposing these endpoints to any HTTP client.

The CVSS score of 9.3 reflects a high‑severity vulnerability, while the EPSS score of < 1 % suggests that, at the time of this analysis, the exploitation probability is low but not negligible. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers can trigger the flaw simply by sending crafted HTTP GET or POST requests to the exposed endpoints; no credentials are required. Because the application accepts unauthenticated requests and concatenates input directly into SQL statements, the attack path is straightforward and could be leveraged if the system is exposed to the internet.