CVE-2026-11585: SQL Injection in CodeAstro Student Attendance System 1.0

Technical summary

CVE-2026-11585 is a SQL injection vulnerability (CWE-89, CWE-74) present in CodeAstro Student Attendance Management System 1.0. The vulnerability exists in /attendance-php/Admin/createClassArms.php where the classId argument is processed without sufficient input validation or parameterized query protection. An authenticated user with access to the affected endpoint can craft a malicious classId value containing SQL metacharacters to execute arbitrary database queries. The attack vector is network-based, requires valid credentials, and does not require user interaction beyond the attacker's own actions.

Business impact

This vulnerability poses a moderate risk to educational institutions and organizations using CodeAstro for attendance tracking. Authenticated administrators or users with access to class management features could read sensitive student records, modify attendance data, alter grades or enrollments, or potentially escalate privileges within the application. Data integrity of attendance records—critical for institutional compliance and reporting—cannot be assured. The reputational and operational impact depends on an organization's reliance on system data for accreditation, financial aid processing, or regulatory reporting.

Affected systems

CodeAstro Student Attendance Management System version 1.0 is confirmed affected. The vulnerability specifically impacts the Admin createClassArms functionality. Organizations running this product should inventory instances, particularly those internet-facing or accessible to untrusted administrative users. Verify your deployment version against vendor advisories, as patched versions may be available.

Exploitability

The vulnerability is moderately exploitable. Public disclosure has occurred, increasing the likelihood that proof-of-concept or attack tooling may emerge. However, exploitation requires valid authentication credentials—an attacker must already have admin or class-management access to the application. This reduces opportunistic exploitation risk but increases insider threat and compromised-account scenarios. The attack surface is limited to authenticated sessions.

Remediation

Apply a patched version of CodeAstro Student Attendance Management System released by the vendor. Verify the specific version number in the vendor advisory. As an interim measure, restrict network access to the /attendance-php/Admin/ directory to trusted IP ranges, enforce strong authentication policies, and monitor for unusual database query patterns or admin activity. Conduct a database audit to detect any unauthorized modifications to attendance records since deployment.

Patch guidance

Contact CodeAstro support or consult the vendor's advisory for the patched version. Apply updates in a test environment first to verify compatibility with your institutional integrations. Given the authentication requirement, patch deployment can typically be scheduled outside emergency windows, but should not be deferred indefinitely given public disclosure. Document the patch version applied for compliance and audit purposes.

Detection guidance

Monitor application logs for failed SQL syntax errors in the createClassArms.php handler, particularly those containing SQL keywords (UNION, SELECT, OR, AND) in the classId parameter. Query database audit logs for unexpected administrative queries or data access patterns initiated from the Admin interface. Look for HTTP requests to /attendance-php/Admin/createClassArms.php with unusual or Base64-encoded classId values. Implement Web Application Firewall (WAF) rules to block requests containing SQL injection patterns targeting this endpoint.

Why prioritize this

While CVSS 6.3 (Medium) reflects the authentication requirement, this vulnerability should be prioritized for patching in the near term because: (1) public disclosure increases weaponization risk, (2) educational data is sensitive and regulated in many jurisdictions, (3) attendance record integrity is fundamental to institutional operations, and (4) insider threats and credential compromise are realistic attack vectors in educational environments. Organizations should patch within 30–60 days depending on their patch management cycle.

Risk score, explained

CVSS 6.3 reflects a vulnerability with network accessibility and low complexity, but tempered by the requirement for prior authentication (PR:L). The impact scores of Low (C:L, I:L, A:L) indicate the attacker can read and modify data but cannot cause complete system denial. The lack of scope change (S:U) limits the blast radius. The score accurately captures a notable but not critical risk; however, context—such as exposure of sensitive student data—may warrant organizational risk elevation.

Frequently asked questions