Executive brief
CodeAstro Apartment Visitor Management System, a software used to track and manage visitors in residential complexes, contains a security flaw in its apartment editing feature. An attacker can exploit this to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive resident information or the alteration of system records. This could result in a loss of data integrity and privacy for the apartment management and its tenants.
Technical details
A SQL injection vulnerability exists in CodeAstro Apartment Visitor Management System 1.0 within the '/apartment-visitor/edit-apartment.php' file. The issue stems from the application's failure to properly sanitize or validate the 'editid' GET parameter before using it in a SQL query. An attacker with low-level privileges can provide malicious input (such as boolean-based or time-based blind payloads) to manipulate database queries. This can lead to unauthorized data extraction, modification, or deletion. The exploit has been publicly disclosed with proof-of-concept payloads available, including UNION-based and time-based blind techniques. No official patch is currently noted, but remediation should involve implementing prepared statements and parameterized queries.
Affected products
- CodeAstro Apartment Visitor Management System 1.0
Timeline
- 2026-06-07: disclosed: Public disclosure via GitHub issue
- 2026-07-06: advisory: NVD publication date