CVE-2025-14090
📋 TL;DR
This vulnerability allows remote attackers to execute SQL injection attacks against AMTT Hotel Broadband Operation System 1.0 by manipulating the ID parameter in the /manager/card/cardmake_down.php file. The exploit is publicly available and can be initiated remotely without authentication. Organizations using this specific hotel management system are affected.
💻 Affected Systems
- AMTT Hotel Broadband Operation System
📦 What is this software?
Hibos by Amttgroup
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including theft of sensitive guest information, financial data, and administrative credentials, potentially leading to system takeover and lateral movement within the network.
Likely Case
Data exfiltration of guest records, payment information, and system configuration details, potentially enabling further attacks against the hotel's infrastructure.
If Mitigated
Limited impact with proper input validation, database permissions, and network segmentation preventing successful exploitation or limiting data exposure.
🎯 Exploit Status
Exploit code is publicly available on GitHub, making this easily weaponizable. The vendor has not responded to disclosure attempts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider implementing workarounds or replacing the software.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the /manager/card/cardmake_down.php endpoint
# Example ModSecurity rule: SecRule ARGS:id "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQLi attempt detected'"
Access Restriction
linuxRestrict access to the vulnerable endpoint using network controls or authentication
# Apache: <Location "/manager/card/cardmake_down.php"> Require ip 10.0.0.0/8 </Location>
# Nginx: location /manager/card/cardmake_down.php { deny all; }
🧯 If You Can't Patch
- Isolate the system on a segmented network with strict firewall rules limiting inbound/outbound connections
- Implement database-level controls: use least privilege accounts, enable query logging, and regularly audit database activity
🔍 How to Verify
Check if Vulnerable:
Test the /manager/card/cardmake_down.php endpoint with SQL injection payloads in the ID parameter (e.g., ID=1' OR '1'='1)Check Version:
Check system documentation or web interface footer for version informationVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and that input validation is properly implemented📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web application logs
- Multiple failed login attempts or SQL error messages in application logs
- Unexpected database connections or query patterns
Network Indicators:
- HTTP requests to /manager/card/cardmake_down.php with SQL injection patterns in parameters
- Unusual outbound database connections from web server
SIEM Query:
source="web_logs" AND uri="/manager/card/cardmake_down.php" AND (param="*' OR*" OR param="*UNION*" OR param="*SELECT*" OR param="*--*" OR param="*/*")