Scans probe PIAF-HMS hospitality PBX software
SANS ISC observed reconnaissance scans from a single IP hunting for the abandoned PIAF-HMS hotel PBX management application, which lacks input validation and access control.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
SANS ISC's Internet Storm Center detected scanning activity targeting installations of PIAF-HMS (PBX in a Flash Hospitality Management System), an old and apparently abandoned open-source project for hotel PBX/Asterisk integration. The scans, using the distinctive User-Agent "Farez-Sorter/1.0", probed paths including /PIAF-HMS/, /admin/, /admin/config.php, /ucp/, /hms/, and /hotel/, suggesting the actor is enumerating for this specific application and related admin panels.
The analyst notes the software has not been meaningfully updated in roughly 10 years, contains numerous SQL injection issues (a recent one was reported publicly a few months ago), and appears to lack authentication and access control entirely. It is unclear whether the application has ever been deployed in production or was primarily a lab/testing tool for PBX integration. All observed scanning traffic originated from a single source IP, 94.102.49.125, associated with IP Volume AS202425, a network often flagged as a bulletproof hosting provider.
While no confirmed exploitation or compromise has been reported, the author raises the concern that hospitality/PBX systems are attractive soft targets — both for stealing guest personal data and for enabling man-in-the-middle style call manipulation, such as an attacker appearing to call from "inside" the property. Defenders operating hotel management or PBX-adjacent systems, particularly any legacy PIAF-HMS deployments, should check logs for the noted User-Agent and source IP, verify whether such abandoned software is exposed to the internet, and consider decommissioning or isolating it given the lack of authentication and known injection flaws.
Source reporting: https://isc.sans.edu/diary/rss/33344
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs