Visitor Management System CVE-2026-10170

Authentication is required: the CVSS vector specifies PR:L (low-privilege authenticated user), meaning an attacker must hold a valid low-level account on the application before exploiting this vulnerability. The injection point is specifically the phone parameter submitted to /vms/php/phone_0.php - exploitation is limited to this endpoint and parameter. The target must be running code-projects Visitor Management System 1.0 on a PHP/MySQL stack. Exploitation is further constrained by RC:R (reasonable confidence) in the CVSS temporal vector, indicating the vulnerability is not yet fully vendor-confirmed. What limits exploitation: the PR:L requirement means anonymous internet users cannot directly exploit this; an attacker must first obtain credentials (via phishing, credential stuffing, or default credentials). The RCE escalation step additionally depends on the MySQL user having FILE privileges or equivalent write access, which is not guaranteed in hardened deployments.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L scores 6.3 (Medium), reflecting network exploitability at low complexity but requiring low-privilege authentication. The temporal modifiers E:P (proof of concept) and RC:R (reasonable confidence, not vendor-confirmed) are present, slightly suppressing the score. However, the GitHub exploit repository explicitly chains SQLi to RCE, which - if reliable - implies a real-world impact of C:H/I:H rather than C:L/I:L. The CVSS impact scope likely understates the actual risk if the RCE chain is functional. EPSS data is not provided in the available intelligence; given VulDB as the sole reporter and no KEV listing, exploitation appears opportunistic rather than targeted at this time. The combination of low-complexity, network-accessible, published RCE chain against an open-source application commonly deployed without hardening makes this a credible risk despite the medium CVSS score. No conflicting signals, but the discrepancy between CVSS impact ratings and the documented RCE escalation should be noted by defenders.

An attacker with a low-privilege account on the Visitor Management System sends a crafted HTTP request to /vms/php/phone_0.php with a malicious phone parameter containing SQL injection syntax (e.g., a stacked query or UNION-based payload). The publicly available exploit chain on GitHub demonstrates that this injection can be escalated - likely via MySQL file-write primitives - to deploy a PHP webshell on the server, achieving remote code execution under the web server process account. Since AC:L and no UI interaction is required, this chain can be scripted and executed rapidly once valid credentials are obtained.