The flaw is a remote SQL injection in the apartment-visitor/action-visitor.php endpoint of CodeAstro’s Apartment Visitor Management System 1.0. By manipulating the unmapped remark parameter an attacker can inject arbitrary SQL statements into the backend query, potentially reading, modifying or deleting data from the database. The weakness aligns with CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and also involves improper handling of special characters indicated by CWE-74.

Only the 1.0 release of CodeAstro’s Apartment Visitor Management System is affected. The vulnerability exists in the action-visitor.php script accessed via /apartment-visitor/action-visitor.php and is not known to impact other modules, versions, or Products.

With a CVSS score of 5.3 the vulnerability is considered moderate. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Because the attack vector is remote, any unauthenticated user who can reach the endpoint and supply a crafted remark value could exploit the flaw, leading to potential data exposure or loss, although the overall risk remains limited by the low exploitation likelihood.