Executive brief
CodeAstro Apartment Visitor Management System, a software used to track and manage visitors in residential complexes, contains a security flaw. An attacker with basic user access can exploit this to manipulate the underlying database. This could lead to the unauthorized viewing of sensitive resident or visitor information, data tampering, or disruption of the management system's operations.
Technical details
A SQL injection vulnerability exists in CodeAstro Apartment Visitor Management System 1.0 within the '/apartment-visitor/action-visitor.php' file. The root cause is the improper neutralization of the 'remark' POST parameter, which is used directly in SQL queries without adequate sanitization or prepared statements. A remote attacker with low-level privileges can provide a specially crafted 'remark' value (e.g., using time-based blind payloads like SLEEP) to execute arbitrary SQL commands. This can result in unauthorized database access, data exfiltration, or modification of visitor records. A public exploit has been disclosed.
Affected products
- CodeAstro Apartment Visitor Management System 1.0
Timeline
- 2026-06-07: disclosed: Vulnerability details and POC shared on GitHub issue tracker.
- 2026-07-06: advisory: CVE-2026-14795 published.