The flaw is a remote SQL injection in the /apartment-visitor/action-visitor.php script where the remark parameter is incorporated into an SQL statement without proper neutralization. An attacker who can supply a crafted remark value can inject arbitrary SQL, potentially reading, modifying, or deleting data from the backend database. The weakness aligns with CWE‑89 (Improper Neutralization of Special Elements in an SQL Command) and additionally involves CWE‑74 (Improper Handling of Special Characters).

The vulnerability affects CodeAstro’s Apartment Visitor Management System as identified in the description, specifically the 1.0 release. No other versions are explicitly mentioned in the CVE data.

With a CVSS score of 5.3 the flaw is considered moderate. The EPSS score is less than 1 %, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is remote via the remark parameter, any unauthenticated user who can reach the endpoint may exploit the flaw, but overall risk remains limited by the low exploitation likelihood.