This vulnerability exists in Apartment Visitors Management System V1.1 within the username parameter of the login page (index.php). An attacker can inject malicious SQL code to alter the authentication query, enabling unauthorized access to sensitive database contents. The vulnerability is publicly disclosed but lacks a CVSS score and vendor-provided remediation details.

Successful exploitation could lead to unauthorized disclosure of sensitive data stored in the backend database. Since the vulnerability is exploitable without authentication, it poses a significant risk to confidentiality. No information is available about privilege escalation or data modification impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and parameterized queries to mitigate SQL injection risks in the affected parameter.