An unauthenticated remote SQL injection vulnerability in Campcodes Online Apartment Visitor Management System 1.0 allows attackers to manipulate database queries without authorization.

This vulnerability is a SQL injection flaw located in the search-visitor.php script, specifically within the searchdata argument. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database.

The ability for an unauthenticated attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive visitor information or the compromise of the underlying database server. With a CVSS score of 7.3, this high-severity vulnerability warrants immediate attention to prevent potential data breaches or unauthorized administrative access.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the search-visitor.php file or disable the affected module until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for anomalous URL patterns containing SQL syntax or unusual query parameters directed at search-visitor.php.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing common SQL injection payloads targeted at the searchdata parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as referenced in the vulnerability disclosure via GitHub.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability presents a tangible risk to organizations utilizing this software. Administrators are strongly advised to implement the suggested compensating controls immediately and prioritize monitoring for any signs of exploitation while awaiting an official security patch from the vendor.