A flaw exists in the phone_0.php script of the code-projects Visitor Management System, where the phone parameter is improperly validated. Manipulating this argument allows an attacker to inject arbitrary SQL statements, potentially enabling data exfiltration or modification. The description indicates that the attack can be initiated from a remote source and that an exploit has already been published.

Vendor code-projects, product Visitor Management System, version 1.0. The vulnerability specifically affects the phone_0.php component within the /vms/php directory of this version.

The CVSS score of 5.3 suggests a medium severity, and the EPSS score is not available, implying limited publicly available exploitation data. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending crafted requests to the phone_0.php endpoint, potentially leading to unauthorized database access or data modification. Given the published exploit, the risk to organizations running the affected version is non-negligible and should be addressed promptly.