This vulnerability affects AMTT Hotel Broadband Operation System 1.0 and involves SQL injection via the ID parameter in the /manager/card/cardhand_submit.php file. An attacker with network access can remotely manipulate this parameter to inject SQL commands, potentially compromising the backend database. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. The vendor has not provided any response or patch, and no official remediation guidance is available.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the CVSS vector indicates that the attack requires high privileges and has low to limited impact on confidentiality, integrity, and availability. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing network-level protections such as restricting access to the affected endpoint and employing web application firewalls to detect and block SQL injection attempts. Monitor for any updates from the vendor regarding official fixes.