Scans Targeting Hospitality Applications, (Wed, Sep 16th)
Scans from a bulletproof-hosting IP target the abandoned PIAF-HMS hospitality application, which contains numerous unpatched SQL injection flaws.
SANS ISC observed requests for /PIAF-HMS/ using the unusual user-agent Farez-Sorter/1.0, along with paths like /admin/, /ucp/, /hms/, and /hotel/, starting September 15 from the single source IP 94.102.49.125 (IP Volume, AS202425, a bulletproof hoster). PIAF-HMS, a PBX in a Flash Hospitality Management System, was last updated 10 years ago and a SQL injection vulnerability was reported recently; the code shows many injection flaws and lacks authentication and access control. The handler notes hotels are soft targets for personal data theft and guest MitM attacks, and asks for community insight on the campaign.
- Scans began September 15 from sole IP 94.102.49.125, tied to bulletproof hoster IP Volume (AS202425).
- PIAF-HMS is effectively abandoned; its last update added a license file 10 years ago.
- A SQL injection flaw was reported recently; code review shows many more plus missing authentication.
- Hotels are attractive targets for stealing guest data and launching MitM attacks against guests.
- Vendors
- SANSPBX in a Flash
- Products
- PIAF-HMS
- Organizations
- SANS Internet Storm CenterIP Volume
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 94.102.49.125 | continuing today. The only source IP for the scans is %%ip:94.102.49.125%%. This IP address is associated with IP Volume ( AS202425) |
From the original article
1 min read at isc.sans.eduEarlier today, I noted an odd request showing up in our "First Seen" report:
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.