Apartment Visitor Management System CVE-2026-77019

No authentication is required - the vulnerable endpoint /apartment-visitor/forgotpw.php is part of the public-facing password recovery flow and accepts the secode parameter before any session is established, confirmed by CVSS PR:N and UI:N. The application must be deployed and network-reachable by the attacker (AV:N). No special configuration is needed beyond a default installation of version 1.0. Exploitation is limited by: (1) the application's niche deployment footprint reducing target availability, (2) the impact ceiling of VC:L/VI:L/VA:L indicating partial rather than full database control depending on database user privilege configuration, and (3) the requirement that the PHP application is actively running and accessible on a reachable host. No non-default feature flags or specific OS platform requirements have been identified.

The CVSS 4.0 score of 6.9 (Medium) reflects a network-accessible, unauthenticated, low-complexity attack with partial confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L), consistent with SQL injection enabling database enumeration and limited data manipulation rather than full system compromise. No EPSS data was provided; however, the combination of a public POC (E:P in the CVSS 4.0 vector) and an unauthenticated attack surface elevates practical risk above what the numerical score alone suggests for organizations actually running this software. The absence of a CISA KEV listing indicates no confirmed mass or targeted exploitation has been reported to authorities. The primary limiting factor is prevalence - CodeAstro products are niche PHP starter scripts with minimal enterprise footprint, so blast radius is inherently constrained. For organizations that have deployed this application, the risk should be treated as high due to the authentication bypass potential of the forgot-password vector and the public exploit.

An unauthenticated remote attacker identifies a publicly accessible instance of CodeAstro Apartment Visitor Management System and sends a crafted HTTP request to /apartment-visitor/forgotpw.php with a SQL payload embedded in the secode parameter (e.g., a UNION-based or boolean-blind injection string). Using the publicly available POC as a template, the attacker enumerates the database schema and extracts credential hashes or session tokens, potentially enabling full application account takeover without needing prior access.