This vulnerability in CodeAstro Apartment Visitor Management System 1.0 involves SQL injection via the email parameter in the password-recovery.php file. An attacker can remotely exploit this flaw to inject malicious SQL commands, potentially compromising the backend database. The CVSS 4.0 base score is 6.9, indicating a medium severity risk. No official fix or patch has been disclosed by the vendor, and the vulnerability remains unmitigated as of the publication date. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows remote attackers to perform SQL injection attacks on the backend database through the email parameter in the password-recovery.php script. This could lead to unauthorized data access or manipulation. However, the vulnerability has a medium severity rating and requires no privileges or user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the password-recovery.php functionality or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the email parameter.