Executive brief
A security vulnerability exists in the CodeAstro Student Attendance Management System, a software tool used to track and manage student records. An attacker with administrative access can exploit this flaw to manipulate the underlying database. This could lead to the unauthorized viewing of sensitive student information, modification of records, or disruption of the attendance tracking service.
Technical details
A SQL injection vulnerability exists in CodeAstro Student Attendance Management System 1.0 within the '/attendance-php/Admin/createStudents.php' file. The root cause is the improper neutralization of the 'admissionNumber' POST parameter before its use in a database query. An authenticated attacker with administrative privileges can send specially crafted SQL commands to perform time-based blind SQL injection. Successful exploitation allows for unauthorized database access, data exfiltration, and potential tampering with student records. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- CodeAstro Student Attendance Management System 1.0
Timeline
- 2026-05-26: disclosed: Initial disclosure on GitHub issues
- 2026-06-13: advisory: NVD/VulDB publication