Executive brief
The CodeAstro Apartment Visitor Management System is a PHP-based web application for managing visitor access to residential properties. A SQL injection vulnerability in the password recovery feature allows attackers to bypass authentication, access sensitive visitor and resident data, modify or delete records, and potentially take complete control of the underlying database without requiring credentials.
Technical details
A SQL injection vulnerability exists in the password-recovery.php file where the 'email' parameter is concatenated directly into SQL queries without proper input validation, sanitization, or prepared statements. An unauthenticated attacker can send a crafted POST request with malicious SQL payloads in the email parameter to manipulate query logic, including time-based blind SQL injection techniques for data exfiltration. The vulnerability allows complete database compromise, including unauthorized access to sensitive information, data manipulation, and potential remote code execution depending on database permissions. Patching requires implementation of prepared statements with parameterized queries, strict input validation, and application of principle of least privilege to database accounts.
Affected products
- CodeAstro Apartment Visitor Management System 1.0
Timeline
- 2026-07-05: disclosed: Vulnerability reported on GitHub
- 2026-08-20: advisory: CVE-2026-77020 published