CVE-2026-11584: Student Attendance System SQLi Vulnerability

CVE-2026-11584 Overview

CVE-2026-11584 is a SQL injection vulnerability in CodeAstro Student Attendance Management System 1.0. The flaw resides in the /attendance-php/Admin/createClass.php script when the action=edit parameter is invoked. An authenticated attacker can manipulate the ID argument to inject arbitrary SQL statements into the underlying database query. The vendor has publicly disclosed the exploit, and remote exploitation is feasible over the network. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated attackers can manipulate database queries through the ID parameter, potentially exposing student records, class data, and administrative information stored in the application backend.

Affected Products

CodeAstro Student Attendance Management System 1.0
File: /attendance-php/Admin/createClass.php
Vulnerable parameter: ID (when action=edit)

Discovery Timeline

2026-06-08 - CVE-2026-11584 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11584

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input passed to a downstream SQL interpreter. The createClass.php script processes the ID argument from the request without applying parameterized queries or input sanitization. When the action=edit workflow executes, the ID value is concatenated directly into a SQL statement. Attackers exploit this by crafting ID values that break out of the intended query context and append attacker-controlled SQL fragments. According to EPSS data published on 2026-06-11, the probability of exploitation in the wild remains low at the time of writing, though public exploit disclosure increases risk over time.

Root Cause

The root cause is a missing input validation and parameterization layer in the createClass.php administrative endpoint. The application trusts the ID query string parameter and interpolates it into a SQL query string. This permits classic SQL injection payloads such as boolean-based, UNION-based, or time-based attacks against the backend database.

Attack Vector

The attack vector is network-accessible and requires low-privilege authentication to the administrative interface. An attacker sends a crafted HTTP GET request to /attendance-php/Admin/createClass.php?action=edit&ID=<payload>. The injected SQL is processed by the database engine, returning data or modifying records. No user interaction is required beyond the attacker's session. Public proof-of-concept details are referenced in the GitHub Issue Tracker and VulDB Vulnerability Details.

Detection Methods for CVE-2026-11584

Indicators of Compromise

HTTP requests to /attendance-php/Admin/createClass.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the ID parameter.
Web server access logs showing repeated requests to the createClass.php endpoint from a single source with varying ID parameter values.
Database error messages returned to clients indicating syntax errors, which suggest probing activity.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection payload patterns targeting the ID parameter on PHP administrative endpoints.
Monitor database query logs for malformed statements, unusual UNION operators, or queries returning unexpected row counts originating from the attendance application.
Correlate authentication events with administrative endpoint access to identify low-privilege accounts probing the createClass.php action.

Monitoring Recommendations

Enable verbose logging on the PHP application and underlying MySQL or MariaDB instance to capture full query text and source IP.
Alert on response time anomalies for createClass.php requests, which can indicate time-based blind SQL injection attempts.
Track outbound database connections and large result set transfers from the application server to detect data exfiltration.

How to Mitigate CVE-2026-11584

Immediate Actions Required

Restrict access to the /attendance-php/Admin/ directory using network-level controls or .htaccess rules until a fix is applied.
Audit administrative accounts and rotate credentials for any account with access to the attendance application.
Review database logs for evidence of prior exploitation targeting the createClass.php endpoint.

Patch Information

At the time of NVD publication, no official vendor patch is referenced. Administrators should consult the CodeAstro Security Resource and the VulDB CVE Listing for updated remediation guidance. Until a patch is published, code-level remediation requires replacing dynamic SQL concatenation with prepared statements using PDO or mysqli parameterized queries.

Workarounds

Implement a WAF rule that blocks requests to createClass.php containing SQL metacharacters in the ID parameter.
Apply server-side input validation requiring the ID parameter to be a strict integer before processing.
Disable or remove the createClass.php administrative function if it is not actively used in production.

bash

# Example ModSecurity rule blocking SQLi payloads on the vulnerable endpoint
SecRule REQUEST_URI "@contains /attendance-php/Admin/createClass.php" \
    "chain,id:1011584,phase:2,deny,status:403,msg:'CVE-2026-11584 SQLi attempt'"
    SecRule ARGS:ID "@rx (?i)(union|select|sleep\(|--|';)" "t:none"