CVE-2026-7697
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0 in an unknown function of the file /manager/card/cardhand_submit.php. Manipulation of the argument ID causes SQL injection, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized.
Risk Assessment
A remote attacker could exploit the SQL injection for unauthorized database access or modification. Since the exploit is public, the risk of exploitation is high.
Recommendation
Contact the vendor for a patch or workaround, and until then restrict access to /manager/card/cardhand_submit.php and implement input validation and WAF rules.
Other vulnerabilities in AMTT Hotel Broadband Operation System
See all- CVE-2026-15494Medium
A SQL injection vulnerability has been found in AMTT Hotel Broadband Operation System 1.0 in the file manager/network/switch_status.php. Manipulating the ID argument allows remote exploitation. The exploit has been published and may be used.
- CVE-2025-14090Medium
A security flaw was discovered in AMTT Hotel Broadband Operation System 1.0 affecting the file /manager/card/cardmake_down.php. Manipulation of the ID argument results in SQL injection, and the attack can be initiated remotely. The exploit has been released to the public and may be exploited.
Original NVD description (English source)
A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected is an unknown function of the file /manager/card/cardhand_submit.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS