Executive brief
CodeAstro Student Attendance Management System is a web-based application used to track and manage student attendance records. A security vulnerability in the login component allows remote attackers to bypass security controls or access the underlying database. This could result in the theft of sensitive student information, unauthorized modification of attendance records, or a complete takeover of the management system.
Technical details
A SQL injection vulnerability exists in CodeAstro Student Attendance Management System 1.0 within the '/attendance-php/index.php' file. The root cause is the improper neutralization of special elements in the 'username' POST parameter, which is used directly in SQL queries without adequate validation or prepared statements. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request containing SQL payloads (such as time-based blind injection). Successful exploitation can lead to unauthorized database access, sensitive data exfiltration, and potential administrative bypass. A public exploit (PoC) has been disclosed.
Affected products
- CodeAstro Student Attendance Management System 1.0
Timeline
- 2026-05-25: disclosed: Vulnerability details and PoC shared on GitHub issue tracker.
- 2026-06-08: advisory: CVE-2026-11582 published.