CVE-2026-12175: Student Attendance Management SQLi Flaw

CVE-2026-12175 Overview

CVE-2026-12175 is a SQL injection vulnerability in CodeAstro Student Attendance Management System 1.0. The flaw resides in the /attendance-php/Admin/createStudents.php script, where the admissionNumber parameter is passed to a database query without proper sanitization. An authenticated remote attacker with administrative privileges can manipulate the parameter to inject arbitrary SQL statements. The issue is classified under [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). A public exploit has been disclosed, increasing the likelihood of opportunistic abuse against exposed installations.

Critical Impact
A remote authenticated attacker can inject SQL through the admissionNumber parameter in createStudents.php, leading to unauthorized read, modification, or deletion of student attendance data.

Affected Products

CodeAstro Student Attendance Management System 1.0
Component: /attendance-php/Admin/createStudents.php
Vulnerable parameter: admissionNumber

Discovery Timeline

2026-06-13 - CVE-2026-12175 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12175

Vulnerability Analysis

The vulnerability exists in the student creation workflow of the administrative interface. When an administrator submits the createStudents.php form, the admissionNumber argument is concatenated into a SQL statement without parameterized queries or input escaping. An attacker can supply SQL syntax such as Boolean conditions, UNION SELECT clauses, or stacked queries to alter the intended database operation. The vulnerability requires high privileges, since the endpoint sits under the Admin/ directory and presumes an authenticated session.

According to the VulDB advisory for CVE-2026-12175, the exploit is public and reachable over the network. Exposure is limited because exploitation depends on access to the admin console, but reused admin credentials or weak password policies expand the attack surface.

Root Cause

The root cause is improper neutralization of user-supplied input before it is incorporated into a SQL query. The application trusts the admissionNumber parameter and inserts it directly into the query string used to register a new student record. There is no use of prepared statements or input validation enforcing a numeric or alphanumeric format. This pattern matches [CWE-74] and the SQL injection subclass tracked widely in PHP applications.

Attack Vector

Exploitation occurs over the network through the administrative web interface. An attacker with valid admin credentials submits a crafted HTTP POST request to /attendance-php/Admin/createStudents.php, embedding SQL payload syntax in the admissionNumber field. Successful injection allows attackers to enumerate database tables, exfiltrate stored credentials or student records, modify attendance entries, or escalate to broader database compromise depending on the privileges of the MySQL account used by the application.

No verified exploitation code is included here. Refer to the GitHub issue tracking CVE-2026-12175 and the VulDB vulnerability entry #370816 for technical proof-of-concept details.

Detection Methods for CVE-2026-12175

Indicators of Compromise

HTTP POST requests to /attendance-php/Admin/createStudents.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ; in the admissionNumber field.
Web server access logs showing unusually long or URL-encoded admissionNumber values.
Database error messages referencing createStudents.php query strings appearing in PHP error logs.
Unexpected student records or modified rows in attendance tables outside of normal admin activity windows.

Detection Strategies

Deploy web application firewall (WAF) rules that match SQL injection signatures on POST parameters submitted to admin endpoints.
Enable MySQL general query logging temporarily to capture full statements originating from the application and flag queries containing concatenated payloads.
Correlate admin authentication events with subsequent createStudents.php submissions to identify abnormal request frequency or off-hours activity.

Monitoring Recommendations

Forward web server, PHP, and database logs to a centralized SIEM for correlation and retention.
Alert on any HTTP 500 response from createStudents.php, since SQL syntax errors often surface as server errors during injection attempts.
Track admin account logins from new IP addresses or geolocations to identify credential compromise that could precede exploitation.

How to Mitigate CVE-2026-12175

Immediate Actions Required

Restrict network access to the /attendance-php/Admin/ directory using IP allowlists, VPN access, or reverse proxy authentication.
Rotate administrator credentials and enforce strong, unique passwords for all admin accounts.
Audit recent admin sessions and database contents for signs of injection or unauthorized record changes.
Deploy a WAF rule blocking SQL metacharacters in the admissionNumber parameter until a vendor patch is available.

Patch Information

No official vendor patch is referenced in the NVD entry for CVE-2026-12175 at the time of publication. Monitor the CodeAstro website and the VulDB entry for CVE-2026-12175 for updates. Until a fix is released, apply source-code remediation by rewriting the affected query to use prepared statements with bound parameters and validating that admissionNumber conforms to an expected format before database submission.

Workarounds

Modify createStudents.php to use PDO or mysqli prepared statements with bound parameters for the admissionNumber value.
Apply server-side input validation enforcing an alphanumeric pattern and maximum length on admissionNumber.
Run the application's database user with least-privilege permissions, removing rights such as FILE, DROP, and cross-database access.
Disable or remove the Student Attendance Management System from internet-facing infrastructure if it is not actively required.