A vulnerability was found in Serdar Bayram Ghost Hot Spot up to 20251014. It has been rated as critical. The affected element is an unknown function of the file /Auth.php of the component Login. This manipulation causes sql injection.
This vulnerability is tracked as CVE-2025-12342. The attack is possible to be carried out remotely. Moreover, an exploit is present.
The vendor was contacted early about this disclosure but did not respond in any way.
