Executive brief
The CodeAstro Apartment Visitor Management System, a software used to track and manage visitors in residential complexes, contains a security flaw in its login page. An attacker can exploit this to bypass security controls or access the underlying database without a valid password. This could lead to the theft of resident and visitor information or unauthorized changes to system records.
Technical details
A SQL injection vulnerability exists in CodeAstro Apartment Visitor Management System 1.0 within the '/index.php' (or '/apartment-visitor/index.php') login component. The root cause is the failure to sanitize or validate the 'username' POST parameter before using it in a database query. An unauthenticated remote attacker can submit a crafted SQL payload (such as time-based blind injection) to manipulate the query logic. This can result in unauthorized database access, data exfiltration, or authentication bypass. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- CodeAstro Apartment Visitor Management System 1.0
Timeline
- 2026-06-02: disclosed: Vulnerability details and PoC shared on GitHub issue tracker
- 2026-07-04: advisory: CVE-2026-14640 published