The itsourcecode Apartment Management System 1.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to compromise database integrity.

This vulnerability is a SQL injection flaw (CWE-89) triggered by improper input sanitization of the vid parameter within the /report/visitor_info.php file. The vulnerability is remotely exploitable by an unauthenticated attacker.

Successful exploitation of this SQL injection vulnerability could allow unauthorized parties to access, modify, or delete sensitive data stored within the backend database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to unauthorized information disclosure or service disruption for the management platform.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /report/visitor_info.php endpoint or disable the affected module until an official fix is released by the vendor.

Proactive Monitoring: Security teams should monitor web access logs for suspicious patterns involving the vid parameter and database query logs for evidence of unauthorized SQL commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the Apartment Management System.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the referenced GitHub issue.

The presence of a functional proof-of-concept makes this vulnerability an immediate concern for organizations running the Apartment Management System 1.0. Because no official vendor patch is currently identified, implementing strict network-level access controls and utilizing a WAF to filter malicious traffic is critical to mitigating the risk of unauthorized database interaction.