This vulnerability involves SQL injection in CodeAstro Apartment Visitor Management System 1.0. Specifically, the apartmentno argument in a function within /apartment-visitor/add-apartment.php is susceptible to injection attacks. The vulnerability allows remote attackers to manipulate SQL queries, potentially compromising the database. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, and no user interaction needed. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion within the affected system. The medium CVSS score indicates a moderate risk, with potential impact on data confidentiality and integrity. However, no evidence of active exploitation is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries as temporary mitigations. Monitoring for unusual database activity may also help detect exploitation attempts.