CodeAstro AVMS CVE-2026-14766

Exploitation requires a valid low-privilege authenticated session in the CodeAstro Apartment Visitor Management System (CVSS PR:L confirmed), and the ability to submit arbitrary POST requests to /apartment-visitor/search-result.php over the network (AV:N). No non-default configuration or special feature enablement is required - the search endpoint is a standard application feature. Limiting factors: the attacker must hold at least one application-level credential (PR:L, not unauthenticated); impacts are partial only (VC:L/VI:L/VA:L), limiting the immediate blast radius relative to a full data exfiltration or RCE scenario; and the product's minimal enterprise footprint reduces the realistic pool of targets. Internet-facing deployments with self-registration or guest accounts face the highest risk, as these reduce the credential barrier.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with E:P) signals low-complexity network exploitation requiring only low privilege and no user interaction, with a confirmed public proof-of-concept. Impacts are bounded to partial confidentiality, integrity, and availability on the vulnerable system, with no scope change to downstream systems. No EPSS score was provided in source data, and the absence of a CISA KEV listing indicates no confirmed mass exploitation at time of analysis. Real-world risk is substantially constrained by the product's niche footprint - CodeAstro's AVMS is a PHP demo/tutorial application with minimal enterprise deployment - meaning aggregate exposure is low even though any individual deployment running it internet-facing is at meaningful risk from script-based attacks leveraging the public POC.

An attacker with a low-privilege account on an internet-facing CodeAstro AVMS instance submits a crafted POST request to /apartment-visitor/search-result.php with a searchdata value containing SQL injection syntax (e.g., ' UNION SELECT table_name,2,3 FROM information_schema.tables--), causing the backend query to return schema or data not intended for that user. The public proof-of-concept at https://gist.github.com/menelausx/29aef0a0ab6f289c0f45b379f6d759d7 provides ready-made payloads, meaning exploitation does not require custom tooling. Depending on the database account's privileges, an attacker could exfiltrate visitor records, manipulate entries, or in permissive configurations attempt stacked queries for broader impact.