A critical SQL injection vulnerability in the Apartment Visitors Management System allows unauthenticated attackers to extract sensitive database contents.

The flaw resides in the contactno parameter of the forgot-password.php endpoint, which fails to properly sanitize user input. This allows an unauthenticated attacker to manipulate backend SQL queries to perform unauthorized data extraction.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive information stored within the application database. Given the CVSS score of 8.2, this represents a high-severity risk that could result in significant data breaches and potential compromise of administrative or user credentials.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the forgot-password.php page or take the application offline until a secure update is provided by the vendor.

Proactive Monitoring: Monitor database access logs for anomalous SQL queries or unexpected patterns originating from the forgot-password.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the contactno parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the provided GitHub repository.

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability necessitates immediate defensive action. Organizations utilizing this software must prioritize restricting external access to the vulnerable endpoint to mitigate the risk of data exfiltration until a vendor-supplied patch is available.