An unauthenticated SQL injection vulnerability in AMTT Hotel Broadband Operation System 1.0 allows remote attackers to execute arbitrary database queries.

This flaw is a SQL injection vulnerability (CWE-89) affecting the file /user/portal/get_expiredtime.php. An unauthenticated remote attacker can manipulate the uid argument to execute unauthorized database commands.

The vulnerability allows for unauthorized interaction with the underlying database, which could lead to data exfiltration or potential compromise of the system integrity. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to operational security, especially given the public availability of exploitation details.

Immediate Action: As there is currently no official patch from the vendor, organizations should restrict network access to the affected system or disable the vulnerable get_expiredtime.php functionality if it is not business-critical.

Proactive Monitoring: Inspect web server access logs for suspicious patterns in the uid parameter, specifically looking for common SQL injection strings such as quotes, comments, or union statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the /user/portal/ directory.

Public Exploit Available: Yes, a public proof-of-concept exists and is attributed to the security disclosure hosted on GitHub.

Due to the lack of a vendor-provided patch and the existence of a public proof-of-concept, this vulnerability must be treated with high priority. Administrators should implement strict network segmentation to isolate the affected system from public-facing segments and apply WAF filtering immediately to mitigate the risk of exploitation.