CVE-2025-14090
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A security flaw was discovered in AMTT Hotel Broadband Operation System 1.0 affecting the file /manager/card/cardmake_down.php. Manipulation of the ID argument results in SQL injection, and the attack can be initiated remotely. The exploit has been released to the public and may be exploited.
Risk Assessment
The vulnerability allows remote SQL injection, potentially leading to unauthorized database access and data leakage. Since the exploit is public, the risk is high.
Recommendation
Patch the system as soon as possible or isolate the vulnerable component. Contact the vendor for a fix, as they did not respond to the disclosure.
Other vulnerabilities in AMTT Hotel Broadband Operation System
See all- CVE-2026-15494Medium
A SQL injection vulnerability has been found in AMTT Hotel Broadband Operation System 1.0 in the file manager/network/switch_status.php. Manipulating the ID argument allows remote exploitation. The exploit has been published and may be used.
- CVE-2026-7697Medium
A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0 in an unknown function of the file /manager/card/cardhand_submit.php. Manipulation of the argument ID causes SQL injection, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized.
Original NVD description (English source)
A security flaw has been discovered in AMTT Hotel Broadband Operation System 1.0. This affects an unknown part of the file /manager/card/cardmake_down.php. Performing manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS