A critical SQL injection vulnerability in Campcodes Online Apartment Visitor Management System 1.0 allows unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection flaw located in the /visitor-detail.php file. An unauthenticated attacker can manipulate the editid argument to execute arbitrary SQL commands against the backend database.

The ability for an unauthenticated attacker to inject malicious SQL queries poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive visitor information or administrative credentials, potentially resulting in full system compromise. With a CVSS score of 7.3, this vulnerability represents a high-severity risk that requires immediate attention to prevent data exfiltration.

Immediate Action: As no official patch is currently available, restrict access to the /visitor-detail.php endpoint at the network or web server level. If the functionality is not required, disable the affected module entirely until a vendor-supplied update is released.

Proactive Monitoring: Monitor web server access logs for suspicious patterns in the editid parameter, such as the inclusion of SQL syntax (e.g., SELECT, UNION, or comment characters).

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the /visitor-detail.php file.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the referenced GitHub repository.

Given the availability of a public proof-of-concept and the unauthenticated nature of this vulnerability, immediate mitigation is required. Organizations should prioritize blocking access to the vulnerable endpoint and monitor for signs of unauthorized database interaction until Campcodes releases a formal security patch.