CVE-2026-14795 in Apartment Visitor Management System
Summary
by MITRE • 07/06/2026
A vulnerability has been found in CodeAstro Apartment Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /apartment-visitor/action-visitor.php. Such manipulation of the argument remark leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/06/2026
The CodeAstro Apartment Visitor Management System version 1.0 contains a critical SQL injection vulnerability within its visitor management functionality that poses significant security risks to affected deployments. This vulnerability exists in the /apartment-visitor/action-visitor.php file where user-supplied input is improperly handled, specifically in the remark parameter processing. The flaw allows remote attackers to execute arbitrary SQL commands against the underlying database system through manipulated input values, bypassing normal authentication and authorization mechanisms that should protect database resources.
This vulnerability represents a classic SQL injection attack vector where the application fails to properly sanitize or escape user input before incorporating it into database queries. When an attacker submits malicious data through the remark parameter, the system processes this input directly without adequate validation or parameterization, enabling attackers to inject malicious SQL code that can manipulate database contents, extract sensitive information, or even gain elevated privileges within the database environment. The remote exploitation capability means attackers do not require physical access to the system and can potentially target vulnerable installations over network connections.
The operational impact of this vulnerability extends beyond simple data compromise, as it provides attackers with potential access to all visitor records, including personal identification information, contact details, visit timestamps, and other sensitive data stored within the system. According to CWE classification, this represents a CWE-89 SQL Injection vulnerability that can lead to complete system compromise when combined with other attack vectors. The public disclosure of exploit code significantly increases the risk level as malicious actors can readily leverage existing tools to target vulnerable installations without requiring advanced technical skills.
Organizations using this system should immediately implement mitigations including input validation, parameterized queries, and proper output encoding to prevent SQL injection attacks. The ATT&CK framework categorizes this vulnerability under T1190 Exploit Public-Facing Application, highlighting the importance of maintaining up-to-date security patches and implementing network segmentation to limit potential attack surfaces. Database access controls should be reviewed and restricted to minimize impact if exploitation occurs, while application firewall rules can help detect and block malicious SQL injection attempts. Regular security assessments and vulnerability scanning should be conducted to identify similar issues within the broader application ecosystem.