An IP address associated with a bulletproof hosting provider has been observed scanning for vulnerabilities in the PBX in a Flash Hospitality Management System (PIAF-HMS), an old and likely abandoned hospitality management application. The system has a recently reported SQL injection vulnerability and lacks input validation, authentication, and access control. The scans also include other hospitality-related endpoints. The activity started recently and continues, suggesting reconnaissance for potential exploitation. The focus on PBX systems may indicate attempts to exploit telephony infrastructure for further attacks such as impersonation or man-in-the-middle attacks on hotel guests.

If exploited, the SQL injection vulnerability and lack of authentication in the PIAF-HMS could allow attackers to execute arbitrary SQL commands, potentially leading to data theft or system compromise. Compromise of PBX systems in hotels could enable attackers to conduct man-in-the-middle attacks on guests or impersonate internal calls, posing privacy and security risks. However, no active exploitation has been confirmed at this time.

No official patch or remediation is indicated for the PIAF-HMS, which appears abandoned. Organizations using this system should consider discontinuing its use or isolating it from critical networks. Monitoring and blocking traffic from the identified scanning IP (94.102.49.125) is recommended. Given the lack of authentication and input validation, deploying compensating controls such as network segmentation and intrusion detection may help reduce risk. Patch status is not confirmed; check vendor or community advisories for updates.