Executive brief
CodeAstro's QR Code Attendance Management System is a web-based attendance tracking application for educational institutions. An authenticated administrator can exploit improper access controls in the user account editing function to hijack the super-administrator account, reset its password, and lock out the legitimate owner. This grants complete control over the system and all attendance and personnel data.
Technical details
The vulnerability is a broken access control flaw in the UserController::save() method that validates the submitted role_id value but fails to check the current role of the target user account. An authenticated Administrator can send a POST request to update the Super Administrator account (id=1) with a new role_id and password, resulting in an unrestricted SQL UPDATE that downgrades and compromises the highest-privilege account. No authentication bypass is required; the attacker must already hold Administrator privileges.
Affected products
- CodeAstro QR Code Attendance Management System 1.0
Timeline
- 2026-09-20: disclosed: CVE-2026-94048 published
- 2026-09-20: exploited: Exploit code made public