CVE-2026-12175: SQL Injection in CodeAstro Student Attendance System 1.0

Technical summary

CVE-2026-12175 is a SQL injection vulnerability affecting CodeAstro Student Attendance Management System 1.0, specifically in the /attendance-php/Admin/createStudents.php endpoint. The admissionNumber parameter is inadequately sanitized, allowing authenticated attackers to craft SQL queries that bypass intended database logic. The vulnerability falls under CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection). With CVSS 3.1 score 4.7 (Medium severity), the attack vector is network-based, requires high privilege (admin role), and causes limited confidentiality, integrity, and availability impact per the base vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L.

Business impact

Exploitation allows an insider threat (compromised or malicious admin account) to exfiltrate or corrupt student attendance records, enrollment data, and potentially other database contents. Educational institutions relying on this system for accreditation, reporting, and student progress tracking face data breach, compliance violations (FERPA in the US, GDPR in EU), and operational disruption. Reputation damage and legal liability may follow if sensitive personal information is exposed or tampered with.

Affected systems

CodeAstro Student Attendance Management System version 1.0 is directly affected. Earlier or later versions have not been reported as vulnerable in this disclosure. Organizations running this specific version in production should assume they are at risk.

Exploitability

The exploit is public and does not require sophisticated tools. However, successful exploitation demands valid administrator account credentials—the attacker cannot execute the injection without prior high-privilege authentication. This requirement raises the barrier for external threat actors but remains a significant risk for insider threats or attackers who have compromised an admin account through phishing, credential theft, or other means.

Remediation

Immediate mitigation requires either upgrading to a patched version (consult CodeAstro's security advisory for verified patch versions) or implementing Web Application Firewall (WAF) rules to block SQL injection patterns in the admissionNumber parameter. Input validation and parameterized queries should be enforced at the application level. Until patching is complete, restrict admin access to a minimal set of trusted users and monitor administrative activity for anomalies.

Patch guidance

Contact CodeAstro directly or check their official security advisory for the available patch version. Verify the patch against the vendor's published security notice before deployment. Test the patch in a non-production environment to confirm it resolves the vulnerability without breaking existing student data imports or attendance workflows. Apply the patch during a maintenance window and validate that the admissionNumber field no longer accepts SQL injection payloads.

Detection guidance

Monitor application logs for SQL errors or unusual query patterns originating from the /attendance-php/Admin/createStudents.php endpoint, particularly when the admissionNumber parameter contains SQL keywords (UNION, SELECT, DROP, etc.) or special characters (single quotes, semicolons, dashes). Enable database query logging to detect injection attempts. Web application firewalls should alert on suspicious patterns in the admissionNumber field. Review admin account activity and failed authentication attempts to identify potential credential compromise.

Why prioritize this

Although CVSS score 4.7 is relatively low, the public availability of exploit code, combined with the sensitivity of student data and regulatory exposure, elevates practical risk. Institutions handling FERPA-protected information should prioritize patching to avoid compliance violations. The admin-only requirement mitigates widespread exploitation but does not eliminate insider threat risk or the possibility of lateral movement from compromised admin accounts.

Risk score, explained

The CVSS 3.1 base score of 4.7 reflects the requirement for high privilege (admin authentication) and limited impact scope, resulting in a Medium severity rating. However, this baseline does not account for the public availability of exploit code or the regulatory sensitivity of educational data. Organizations should apply temporal and environmental scoring factors: increase priority if the system is internet-facing, contains FERPA or GDPR data, or has experienced prior admin credential compromise.

Frequently asked questions