CVE-2026-11583: Student Attendance System SQL Injection

CVE-2026-11583 Overview

CVE-2026-11583 is a SQL injection vulnerability in CodeAstro Student Attendance Management System 1.0. The flaw exists in /attendance-php/Admin/createClass.php, where the className parameter is passed unsanitized to a backend SQL query. An authenticated remote attacker can manipulate the parameter to alter query logic, read database contents, or modify records. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed deployments. The issue is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Authenticated attackers can inject arbitrary SQL through the className parameter to read or tamper with the attendance database backing the application.

Affected Products

• CodeAstro Student Attendance Management System 1.0
• Deployments exposing /attendance-php/Admin/createClass.php
• Installations using the default administrative interface shipped by the vendor

Discovery Timeline

• 2026-06-08 - CVE-2026-11583 published to NVD
• 2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11583

Vulnerability Analysis

The vulnerability resides in the administrative class creation workflow of CodeAstro Student Attendance Management System 1.0. When an authenticated administrator submits the class creation form, the className argument is forwarded to createClass.php and concatenated into a SQL statement without parameterization or input filtering. Because the parameter accepts user-controlled input, attackers can append SQL syntax to break out of the intended string context. The result is a classic in-band SQL injection that affects confidentiality, integrity, and availability of the underlying database. Public disclosure of the exploit details raises the risk that automated scanners and opportunistic actors will probe vulnerable instances.

Root Cause

The root cause is missing input neutralization on the className parameter inside createClass.php. The PHP code does not employ prepared statements, parameter binding, or context-aware escaping before passing the value into the database query. Any character with SQL meaning, such as single quotes, comment markers, or UNION keywords, is interpreted as part of the statement. This deviates from secure coding practices documented under [CWE-74] for improper neutralization of injected elements.

Attack Vector

Exploitation is remote and requires low-privileged authenticated access to the admin interface. An attacker submits a crafted POST request to /attendance-php/Admin/createClass.php with malicious SQL embedded in the className field. Because no user interaction beyond the attacker's own session is required, the attack can be scripted. Refer to the VulDB CVE Record and the GitHub Issue Tracker for additional technical detail.

Detection Methods for CVE-2026-11583

Indicators of Compromise

• POST requests to /attendance-php/Admin/createClass.php containing SQL metacharacters such as ', --, ;, or UNION SELECT in the className parameter
• Unexpected new or modified rows in the classes table or related attendance tables outside of normal administrative activity
• Database error messages referencing syntax issues originating from createClass.php in PHP or web server logs

Detection Strategies

• Inspect web server access logs for anomalous request bodies targeting createClass.php, especially payloads exceeding normal class-name length
• Enable database query logging and alert on statements containing tautologies such as OR 1=1 or stacked queries originating from the application user
• Deploy a Web Application Firewall (WAF) rule set with SQL injection signatures tuned to the application's PHP endpoints

Monitoring Recommendations

• Forward web, application, and database logs to a centralized analytics platform for correlation across sessions and source IP addresses
• Track failed and successful administrator logins to identify credential stuffing that could precede exploitation
• Baseline normal createClass.php request patterns and alert on deviations in payload structure or frequency

How to Mitigate CVE-2026-11583

Immediate Actions Required

• Restrict network access to the /attendance-php/Admin/ directory to trusted administrative IP ranges using web server access controls
• Rotate administrator credentials and audit existing admin accounts for unauthorized access
• Review database logs for evidence of prior injection attempts against createClass.php

Patch Information

No official vendor patch has been published at the time of writing. Monitor the CodeAstro Security Resource and the GitHub Issue Tracker for fix availability. Until a patch is released, administrators should apply the workarounds below and consider temporarily disabling the affected endpoint.

Workarounds

• Modify createClass.php to use parameterized queries through PDO or MySQLi prepared statements instead of string concatenation
• Apply server-side input validation that constrains className to an allow-list of expected characters such as alphanumerics and spaces
• Deploy WAF rules that block SQL metacharacters in POST parameters submitted to administrative endpoints
• Run the database account used by the application with least-privilege permissions to limit the blast radius of a successful injection

# Example nginx access restriction for the admin directory
location /attendance-php/Admin/ {
    allow 10.0.0.0/24;
    deny all;
}