This vulnerability involves an SQL injection in the Visitor Management System 1.0 by code-projects. Specifically, the issue is in the handling of the 'phone' parameter in the /vms/php/phone_0.php file. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the backend database. The vulnerability has a CVSS 4.0 score of 5.3, indicating a medium level of severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vendor has not released a patch or official remediation at the time of this report.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of the Visitor Management System. This may lead to unauthorized data access, modification, or deletion depending on the database permissions. The attack can be performed remotely without authentication, increasing the risk of exploitation. However, the CVSS score and available data indicate the impact is limited to low to moderate confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint, applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'phone' parameter, and monitoring for suspicious activity related to this vulnerability. Avoid exposing the affected functionality to untrusted networks if possible.