Executive brief
The CodeAstro Student Attendance Management System, a web application used for tracking student attendance, contains a security flaw that allows unauthorized database access. By sending a specially crafted request to the administrative interface, an attacker can view, modify, or delete sensitive school records. This could lead to data theft, tampering with attendance logs, or a complete loss of data integrity within the system.
Technical details
A SQL injection vulnerability exists in CodeAstro Student Attendance Management System 1.0 within the '/attendance-php/Admin/createClassArms.php' file. The root cause is the improper neutralization of the 'classId' POST parameter before it is used in a database query. A remote attacker with low-level privileges can exploit this by submitting malicious SQL commands, such as time-based blind payloads, to manipulate database queries. Successful exploitation can lead to unauthorized access to sensitive information, data modification, or full database compromise. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- CodeAstro Student Attendance Management System 1.0
Timeline
- 2026-05-25: disclosed: Public issue opened on GitHub with PoC details
- 2026-06-08: advisory: NVD/VulDB advisory published