CodeAstro AVMS CVE-2026-77020

No special conditions are required - exploitation is possible by any remote, unauthenticated actor who can send an HTTP request to the password-recovery.php endpoint of a publicly accessible CodeAstro Apartment Visitor Management System 1.0 instance. No login, session token, prior foothold, or non-default configuration is needed; the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms this. The primary limiting factor is product prevalence: exploitation is constrained to organizations that have deployed this specific niche application and exposed it to untrusted networks. There is no indication from the description, CVSS vector, or CPE data that a specific feature flag or deployment mode is required.

The CVSS 4.0 base score of 6.9 with network attack vector, no authentication, and no complexity requirement reflects a meaningful but bounded risk - the Low ratings across VC/VI/VA indicate partial rather than full database compromise without additional exploit chaining. The E:P modifier in the CVSS 4.0 vector confirms a publicly available proof-of-concept, which elevates urgency above what the base score alone implies, as it reduces the attacker skill threshold to near-zero for any internet-exposed instance. No EPSS probability data was provided in the source intelligence, limiting probabilistic exploitation forecasting; this gap should be noted when prioritizing against other open items. No KEV listing means confirmed in-the-wild exploitation has not been observed by CISA, which is consistent with the product's niche footprint - but the absence of KEV does not preclude opportunistic scanning. The overall risk is moderate-low in aggregate due to low prevalence, but high for any specific organization that has deployed and internet-exposed this application, where the public exploit makes exploitation trivially reproducible.

An unauthenticated attacker sends a crafted HTTP POST request to password-recovery.php with a malicious SQL payload in the email field - for example, a UNION-based injection to retrieve user credentials or a blind boolean payload to enumerate database contents. A public proof-of-concept demonstrating this technique is available at https://github.com/Witiers/CVEs/issues/2, making this reproducible with minimal skill. Depending on the database user's privileges, the attacker may extract password hashes, enumerate registered users, or manipulate records.