This vulnerability in AMTT Hotel Broadband Operation System 1.0 allows remote attackers to perform SQL injection by manipulating the ID parameter in the file manager/network/switch_status.php script. The flaw enables unauthorized database queries due to insufficient input validation or sanitization. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No official fix or mitigation has been provided by the vendor, and exploit code has been published.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction, increasing the risk of attack. However, the CVSS vector indicates that the attack requires high privileges, limiting the scope of exploitation to authenticated users with elevated rights. There is no indication of widespread exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded to disclosure and no fix is provided, users should consider restricting access to the affected component and monitor for suspicious activity. Applying web application firewalls or input validation controls to filter malicious input targeting the ID parameter may provide temporary mitigation. Check the vendor advisory regularly for updates or official fixes.