A remote, unauthenticated SQL injection vulnerability in Campcodes Online Apartment Visitor Management System 1.0 poses a significant risk of unauthorized database interaction.

This vulnerability is a SQL injection flaw located within the bwdates-reports-details.php file. An unauthenticated attacker can manipulate the fromdate or todate parameters to execute arbitrary SQL commands against the backend database.

The ability to perform SQL injection without authentication allows an attacker to bypass standard security controls, potentially leading to the unauthorized disclosure or modification of sensitive visitor and resident data. With a CVSS score of 7.3, this high-severity flaw represents a significant threat to data confidentiality and integrity, which could result in severe reputational damage and regulatory non-compliance.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected interface or disable the visitor management system entirely until a secure update is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing SQL syntax patterns targeting the bwdates-reports-details.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the identified parameters.

Public Exploit Available: Yes, a proof-of-concept exists and is documented in the technical write-up provided via the GitHub reference.

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability must be treated with high priority. Organizations currently utilizing Campcodes Online Apartment Visitor Management System 1.0 should immediately implement network-level access controls to prevent remote exploitation while awaiting a formal security patch from the vendor.