CodeAstro Apartment Visitor Management System 1.0 contains a SQL injection vulnerability in the Login component's /index.php file. An attacker can remotely exploit this by manipulating the Username parameter, potentially allowing unauthorized database queries. The vulnerability is publicly known and exploitable, but no official patch or remediation has been documented at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The CVSS score of 6.9 indicates a medium impact with network attack vector, no privileges or user interaction required, and low confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the Username input to mitigate SQL injection risks.