Apartment Visitor Management CVE-2026-14640

No special conditions are required - exploitation is possible by any attacker with network access to the /index.php login page, with no authentication, no prior account, and no non-default configuration needed (CVSS 4.0: PR:N/UI:N/AC:L/AT:N). The login form is a default-exposed endpoint in any standard deployment. Factors that limit exploitation in practice: (1) the application must be reachable from the attacker's network (internet-facing or on an accessible internal segment); (2) database-level impacts are partial per the CVSS 4.0 VC:L/VI:L/VA:L metrics, meaning full database takeover or remote code execution is not directly implied by this vector alone; (3) the product has a narrow deployment footprint, reducing the number of exposed instances globally.

The CVSS 4.0 score of 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N reflects a network-accessible, zero-complexity, unauthenticated attack path requiring no user interaction - the most permissive possible attack precondition set. The partial CIA impacts (VC:L/VI:L/VA:L) indicate the attacker can read or modify portions of the database rather than achieving full system takeover from this vector alone. The E:P (Proof-of-Concept) temporal modifier confirms public exploit code exists, lowering the skill threshold substantially. No EPSS data was supplied in the input, so probability-based exploitation rate cannot be quantified. There is no CISA KEV listing, meaning mass active exploitation has not been confirmed by U.S. federal intelligence at time of analysis. The primary risk-limiting factor is product prevalence: CodeAstro is a niche PHP script vendor with low enterprise footprint, constraining the realistic attack surface. For the small number of organizations running this product internet-facing, this should be treated as a high-priority remediation item given the trivial exploitation path.

An unauthenticated attacker identifies a publicly accessible CodeAstro Apartment Visitor Management System login page and submits a crafted SQL injection payload - such as a boolean-based blind or UNION-based injection - in the Username field of the /index.php form. The backend SQL query incorporates the unsanitized input, allowing the attacker to enumerate database tables, extract stored credentials or visitor records, or conditionally modify data. A public proof-of-concept is available at https://github.com/kk-333/cve/issues/1, further reducing the skill and time required to carry out this attack.