AMTT Hotel Broadband Operation System (HiBOS) V3.0.3.151204 and before is vulnerable to SQL Injection via /manager/card/card_detail.php.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')