NewsPublished 16 Sep 2026

Scans Targeting Hospitality Applications, (Wed, Sep 16th)

Source SANS ISC Handlers Diary

Description

Scans originating from a single IP address have been targeting an old hospitality management system called PBX in a Flash Hospitality Management System (PIAF-HMS). This application appears abandoned, with the last update 10 years ago, and is known to have an SQL injection vulnerability reported recently. The scans also target other related endpoints such as /admin/, /admin/config.php, /ucp/, /hms/, and /hotel/. The source IP is linked to a bulletproof hosting provider, raising concerns about potential malicious intent. Hotels are considered soft targets due to valuable personal data and the possibility of attackers leveraging compromised PBX systems for man-in-the-middle attacks on guests.

Impact

If exploited, the SQL injection vulnerability and lack of authentication in the PIAF-HMS could allow attackers to execute arbitrary SQL commands, potentially leading to data theft or system compromise. Compromise of PBX systems in hotels could enable attackers to conduct man-in-the-middle attacks on guests or impersonate internal calls, posing privacy and security risks. However, no active exploitation has been confirmed at this time.

Defensive guidance

Organizations using this system should consider discontinuing its use or isolating it from critical networks. Monitoring and blocking traffic from the identified scanning IP (94.102.49.125) is recommended. Given the lack of authentication and input validation, deploying compensating controls such as network segmentation and intrusion detection may help reduce risk.

Summary

An IP address associated with a bulletproof hosting provider has been observed scanning for vulnerabilities in the PBX in a Flash Hospitality Management System (PIAF-HMS), an old and likely abandoned hospitality management application. The system has a recently reported SQL injection vulnerability and lacks input validation, authentication, and access control. The scans also include other hospitality-related endpoints. The activity started recently and continues, suggesting reconnaissance for potential exploitation. The focus on PBX systems may indicate attempts to exploit telephony infrastructure for further attacks such as impersonation or man-in-the-middle attacks on hotel guests.

References

isc.sans.edu/diary/rss/33344 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Sep 2026, 18:46 UTC

References

Community reviews