A flaw was discovered in CodeAstro’s Apartment Visitor Management System (version 1.0) in the visitor-entry.php page. The argument ‘visname’ is concatenated directly into a database query without validation or parameterization, allowing an attacker to insert arbitrary SQL commands. This injection can be triggered remotely through the web interface, and publicly available exploit code demonstrates its feasibility.

The affected product is CodeAstro’s Apartment Visitor Management System, specifically version 1.0. The vulnerability resides in the visitor-entry.php module that processes the visname field.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is reported as less than 1 %, suggesting a low probability of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Because the injection can be triggered by any remote user with internet access to the application, attackers need only craft a HTTP request containing a malicious visname value; no local privileges or additional access are required.