This vulnerability involves an SQL injection in AMTT Hotel Broadband Operation System 1.0, specifically in an unknown function within /manager/card/cardhand_submit.php. An attacker can manipulate the ID parameter to inject SQL commands remotely. The vulnerability was publicly disclosed, but the vendor has not issued any fix or advisory. The CVSS 4.0 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with privileges to remotely execute SQL injection attacks, potentially leading to unauthorized data access or modification within the affected system. The impact is rated medium due to the required privileges and limited confidentiality, integrity, and availability impact as per the CVSS vector. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or remediation guidance has been provided by the vendor. Security teams should monitor for vendor advisories and consider restricting access to the vulnerable endpoint or applying web application firewall rules to detect and block SQL injection attempts targeting the ID parameter in /manager/card/cardhand_submit.php.