# CVE-2026-54419: PIAF-HMS - SQLi

> Live exploitation tracking for CVE-2026-54419 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-54419

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** claudiopizzillo PIAF-HMS
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** web_application

## Description

claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query calls via string concatenation, without sanitization, escaping, or parameterization.

## CrowdSec analysis

[CVE-2026-54419](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-54419) is a critical vulnerability in claudiopizzillo PIAF-HMS, where unauthenticated attackers can exploit multiple SQL injection flaws by sending crafted HTTP parameters. Successful attacks could expose or alter database contents and potentially disrupt the system, with no login or user interaction required.

CrowdSec has been tracking this vulnerability and its exploits since 4th of November 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-54419 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target `/ec.php` with crafted `Ext` parameter values containing SQL injection payloads, such as a `UNION SELECT` that evaluates an MD5 expression. The request also supplies `Checkin` and `Checkout` parameters.

## Timeline

- 2026-06-18: CVE Published. CVE-2026-54419 is published to NVD.
- 2026-11-04: Rule Released. CrowdSec releases a rule to detect CVE-2026-54419 exploitation attempts against the CrowdSec Network.
- 2026-11-04: First exploitation attempt seen by CrowdSec

## References

- https://github.com/claudiopizzillo/PIAF-HMS
- https://github.com/claudiopizzillo/PIAF-HMS/blob/389d2633441b65ced1c104212cd62be2bfca21e5/ec.php#L57
- https://github.com/claudiopizzillo/PIAF-HMS/blob/389d2633441b65ced1c104212cd62be2bfca21e5/rooms.php#L16
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-54419.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-54419) follows observed exploitation activity for CVE-2026-54419. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.