The vulnerability in claudiopizzillo PIAF-HMS arises from multiple unauthenticated SQL injection flaws. The application does not implement authentication and uses deprecated mysql_query calls with direct string concatenation of user input, lacking any sanitization, escaping, or parameterization. This improper neutralization of special elements in SQL commands (CWE-89) enables attackers to execute arbitrary SQL queries. No specific affected versions are stated, and no official patch or remediation guidance is currently available.

Exploitation of this vulnerability can lead to full compromise of the database, including unauthorized data disclosure, data modification, and denial of service. Given the lack of authentication, any remote attacker can exploit these SQL injection flaws without credentials. The CVSS 3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability.

No official fix or patch is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to the application, implementing external web application firewalls with SQL injection protections, or discontinuing use of the affected software.