VORANT. Threat Intelligence Sign in Get the full feed

Scans probe PIAF-HMS hospitality PBX software

routine vulnerability healthcare

SANS ISC observed reconnaissance scans from a single IP hunting for the abandoned PIAF-HMS hotel PBX management application, which lacks input validation and access control.

SANS ISC's Internet Storm Center detected scanning activity targeting installations of PIAF-HMS (PBX in a Flash Hospitality Management System), an old and apparently abandoned open-source project for hotel PBX/Asterisk integration. The scans, using the distinctive User-Agent "Farez-Sorter/1.0", probed paths including /PIAF-HMS/, /admin/, /admin/config.php, /ucp/, /hms/, and /hotel/, suggesting the actor is enumerating for this specific application and related admin panels.

The analyst notes the software has not been meaningfully updated in roughly 10 years, contains numerous SQL injection issues (a recent one was reported publicly a few months ago), and appears to lack authentication and access control entirely. It is unclear whether the application has ever been deployed in production or was primarily a lab/testing tool for PBX integration. All observed scanning traffic originated from a single source IP, 94.102.49.125, associated with IP Volume AS202425, a network often flagged as a bulletproof hosting provider.

While no confirmed exploitation or compromise has been reported, the author raises the concern that hospitality/PBX systems are attractive soft targets — both for stealing guest personal data and for enabling man-in-the-middle style call manipulation, such as an attacker appearing to call from "inside" the property. Defenders operating hotel management or PBX-adjacent systems, particularly any legacy PIAF-HMS deployments, should check logs for the noted User-Agent and source IP, verify whether such abandoned software is exposed to the internet, and consider decommissioning or isolating it given the lack of authentication and known injection flaws.

Detection guidance

HTTP Scanning for PIAF-HMS Application Paths

ATT&CK T1595.002

Detects HTTP requests probing PIAF-HMS-specific paths (/PIAF-HMS/, /admin/, /ucp/, /hms/, /hotel/) typical of vulnerability enumeration against hospitality PBX software. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: HTTP Scanning for PIAF-HMS Application Paths
description: Detects HTTP GET/POST requests targeting PIAF-HMS and related admin panel
  paths, indicating reconnaissance of legacy hospitality PBX systems.
tags:
- attack.reconnaissance
- attack.t1595.002
logsource:
  category: proxy
  product: generic
detection:
  selection:
    http_method:
    - GET
    - POST
    - HEAD
    uri|contains:
    - /PIAF-HMS/
    - /admin/config.php
    - /ucp/
    - /hms/
    - /hotel/
  condition: selection
falsepositives:
- Legitimate administrators accessing PIAF-HMS admin interfaces from internal networks
- Vulnerability scanners or penetration testers authorized by the organization
level: medium
id: 94bb02ce-bfdd-58ad-9715-f59bb0359aac
status: experimental
author: Vorant

HTTP Requests with Farez-Sorter User-Agent

ATT&CK T1595.002

Detects HTTP requests using the distinctive 'Farez-Sorter/1.0' User-Agent associated with automated scanning of PIAF-HMS installations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: HTTP Requests with Farez-Sorter User-Agent
description: Detects HTTP requests carrying the distinctive Farez-Sorter/1.0 User-Agent,
  a recognized scanner targeting PIAF-HMS and other legacy PBX systems.
tags:
- attack.reconnaissance
- attack.t1595.002
logsource:
  category: proxy
  product: generic
detection:
  selection:
    http_user_agent|contains: Farez-Sorter/1.0
  condition: selection
falsepositives:
- Custom internal tools or monitoring scripts using this exact User-Agent string
level: medium
id: e6bb68af-655a-5ace-aa91-50a23e631a12
status: experimental
author: Vorant

PIAF-HMS Admin Panel and Configuration File Access

ATT&CK T1190

Detects direct HTTP requests to PIAF-HMS /admin/config.php or /ucp/ endpoints, indicating exploitation or unauthorized access attempts to unauthenticated admin interfaces. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PIAF-HMS Admin Panel and Configuration File Access
description: Detects HTTP requests to unauthenticated PIAF-HMS admin and UCP endpoints
  (/admin/config.php, /ucp/), suggesting exploitation of unprotected administrative
  interfaces in abandoned PBX software.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
  product: generic
detection:
  selection:
    http_method:
    - GET
    - POST
    uri|contains:
    - /admin/config.php
    - /ucp/
  filter_internal:
    source_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_internal
falsepositives:
- Legitimate internal administrators accessing PIAF-HMS configuration panels from
  corporate networks
- Authorized vulnerability assessments or penetration tests
level: high
id: 05ca52b7-8d50-521f-a5d4-678e7a0f2445
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33344

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free