Visitor Management System CVE-2025-11349
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector, low complexity, no privileges or interaction; limited impact on confidentiality, integrity, availability.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in Campcodes Online Apartment Visitor Management System 1.0. Impacted is an unknown function of the file /search-visitor.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
AnalysisAI
SQL injection in Campcodes Online Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to manipulate the search-visitor.php endpoint via the searchdata parameter. Public exploit code exists, though EPSS probability is low (0.03%), indicating limited exploitation interest. No active exploitation confirmed in CISA KEV.
Technical ContextAI
The vulnerability targets a PHP-based web application for managing apartment visitor logs. The searchdata parameter in /search-visitor.php is passed directly into SQL queries without sanitization, typical of CWE-74 (Injection). The CPE cpe:2.3:a:campcodes:online_apartment_visitor_management_system:1.0 confirms this exact version is affected. The attack exploits a classic SQLi flaw in a POST/GET parameter, common in legacy PHP applications lacking prepared statements.
RemediationAI
No vendor-released patch identified at time of analysis. Implement WAF rules to block SQLi patterns in the searchdata parameter, use prepared statements or parameterized queries in the PHP code, and restrict network access to /search-visitor.php only to trusted IPs. If immediate code fix is possible, apply input validation and escaping via functions like mysqli_real_escape_string or switch to PDO. Side effects of restrictive access include breaking legitimate visitor searches from external sites.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today