CVE-2026-112327

Summary

SQL injection flaw in TMS Amelia booking system (versions through 2.4.11) allows unauthenticated attackers to inject malicious SQL commands via user input, compromising data confidentiality and availability.

Exploitability

Exploitation is straightforward for remote attackers due to lack of authentication or user interaction requirements.

Blast radius

Successful exploitation could expose sensitive booking and user data, disrupt service availability, and potentially enable further lateral movement within the underlying database infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Amelia version 2.5 or later, as the description implies a fix exists beyond affected versions through 2.4.11.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.