Listen to this Post
The CVE-2025-14090 vulnerability is a SQL injection flaw within the AMTT Hotel Broadband Operation System version 1.0.
The specific point of failure is the `ID` parameter processed by the file at /manager/card/cardmake_down.php.
This PHP script does not properly sanitize or validate user-controlled input before using it in database queries.
An attacker can remotely send HTTP requests, such as GET or POST, that include malicious SQL code within the `ID` parameter.
For example, supplying an ID value like `1′ OR ‘1’=’1` could manipulate the query’s logic to bypass authentication or access controls.
The underlying SQL query might be constructed unsafely via string concatenation: "SELECT FROM cards WHERE id = " . $_REQUEST['ID'].
This allows the attacker to inject arbitrary SQL commands, including UNION SELECT statements to extract data from other tables.
Commands for data modification (INSERT, UPDATE, DELETE) or database schema alteration (DROP TABLE) could also be executed.
The attack is feasible remotely (AV:N) with low attack complexity (AC:L), though it requires high privileges (PR:H).
The public release of the exploit code increases the likelihood of active attacks against unpatched systems.
Successful exploitation can lead to disclosure of sensitive hotel guest data, disruption of broadband services, or full system compromise.
The vendor was notified but has not provided a patch or any mitigation guidance, leaving systems permanently at risk.
The CVSS 4.0 vector scores it as medium severity due to impacts on confidentiality, integrity, and availability being low (VC:L/VI:L/VA:L).
Platform: AMTT Hotel Broadband
Version: 1.0
Vulnerability: SQL Injection
Severity: Medium
date: 2025-12-05
Prediction: No patch expected
What Undercode Say:
Analytics:
curl -v “http://TARGET/manager/card/cardmake_down.php?ID=1%27%20AND%201=1–”
sqlmap -u “http://TARGET/manager/card/cardmake_down.php?ID=1” –batch
cat exploit_payload.txt
‘ UNION SELECT user(),database()– –
; DROP TABLE cards; —
How Exploit:
Send crafted HTTP request with malicious SQL in ID parameter.
Use automated tools like sqlmap for enumeration.
Execute arbitrary database commands remotely.
Protection from this CVE
Implement input validation and sanitization.
Use parameterized queries (PDO, prepared statements).
Deploy a web application firewall (WAF).
Apply network segmentation and restrict access.
Impact:
Unauthorized data access and theft.
Potential system disruption or downtime.
Full database compromise and loss of integrity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
