Executive brief
The CodeAstro Student Attendance Management System, a web application used for tracking student records, contains a security flaw in its administrative interface. An attacker with basic user access can exploit this vulnerability to manipulate database queries. This could lead to unauthorized access to sensitive student information, data tampering, or disruption of the attendance tracking service.
Technical details
A SQL injection vulnerability exists in CodeAstro Student Attendance Management System 1.0 within the '/attendance-php/Admin/createClass.php' file. The root cause is the improper neutralization of the 'Id' GET parameter when the 'action' is set to 'edit' or 'delete', allowing user-supplied input to be concatenated directly into SQL queries. A remote attacker with low-privileged (authenticated) access can exploit this using time-based blind SQL injection techniques. Successful exploitation allows for unauthorized database access, potentially leading to the extraction of sensitive data or modification of records. A public proof-of-concept (PoC) using sqlmap has been disclosed.
Affected products
- CodeAstro Student Attendance Management System 1.0
Timeline
- 2026-05-25: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-06-08: advisory: CVE-2026-11584 published.