Executive brief
The CodeAstro Apartment Visitor Management System, a software used to track and manage visitors in residential complexes, contains a security flaw. An attacker can use this vulnerability to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive visitor information or disruption of the system's operations. This issue is particularly concerning because technical details and exploit methods are publicly available.
Technical details
A SQL injection vulnerability exists in CodeAstro Apartment Visitor Management System 1.0 within the '/apartment-visitor/visitor-entry.php' file. The root cause is the improper neutralization of the 'visname' POST parameter before it is used in a SQL query. A remote attacker with low privileges can exploit this by sending a specially crafted HTTP request containing a malicious SQL payload (such as time-based blind injection). Successful exploitation allows for unauthorized database access, data exfiltration, and potential system compromise. A public proof-of-concept (PoC) using sqlmap has been disclosed.
Affected products
- CodeAstro Apartment Visitor Management System 1.0
Timeline
- 2026-06-07: disclosed: Initial disclosure on GitHub by lilukun337/cve/issues/10
- 2026-07-06: advisory: NVD publication date