Executive brief
The CodeAstro Apartment Visitor Management System, a software used to track and manage building visitors, contains a security flaw in its search functionality. An attacker can exploit this to gain unauthorized access to the underlying database, potentially exposing sensitive visitor records or administrative credentials. This could lead to a complete breach of the system's data integrity and confidentiality.
Technical details
A SQL injection vulnerability exists in CodeAstro Apartment Visitor Management System 1.0 within the /apartment-visitor/search-result.php component. The root cause is the direct concatenation of the 'searchdata' POST parameter into SQL queries without proper sanitization or the use of prepared statements. A remote attacker with low-level privileges can provide malicious input to manipulate database queries, enabling them to extract sensitive information, modify records, or potentially gain full control over the database. Public exploit code, including SQLmap payloads for time-based blind and UNION-based attacks, has been disclosed.
Affected products
- CodeAstro Apartment Visitor Management System 1.0
Timeline
- 2026-07-05: advisory: NVD publication date
- 2026-06-07: disclosed: Public exploit gist published by researcher