Executive brief
CodeAstro's Apartment Visitor Management System is a PHP web application used to manage visitor access to apartment buildings. The system contains a SQL injection vulnerability in its password-reset functionality that allows attackers to manipulate database queries remotely. Attackers can exploit this to steal sensitive resident data, modify records, gain unauthorized access to systems, or disrupt service availability.
Technical details
The vulnerability is a SQL injection flaw in the /apartment-visitor/forgotpw.php file, specifically in the 'secode' parameter, which is processed without proper input validation or parameterized queries. An unauthenticated remote attacker can inject malicious SQL code through POST requests to manipulate database operations. The vulnerability allows time-based blind SQL injection attacks (confirmed via sqlmap testing with SLEEP() payloads), enabling database reconnaissance, data exfiltration, modification, or deletion. No vendor patch information is currently available; remediation requires implementation of prepared statements, input validation, and least-privilege database accounts.
Affected products
- CodeAstro Apartment Visitor Management System 1.0
Timeline
- 2026-07-05: disclosed: Vulnerability reported on GitHub
- 2026-08-20: advisory: CVE-2026-77019 published by NVD