Student Attendance Management System CVE-2026-11584

Exploitation requires the attacker to be authenticated with at minimum a low-privilege account on the CodeAstro Student Attendance Management System admin interface - confirmed by CVSS PR:L. The vulnerable endpoint /attendance-php/Admin/createClass.php must be reachable over the network (AV:N), and the 'action=edit' query parameter must be invoked. No special non-default configuration is required beyond having the application deployed and accessible. Exploitation is limited by the authentication prerequisite (PR:L): unauthenticated internet-facing exploitation is not possible based on the CVSS vector. Impact is further bounded to low-severity data read/write (VC:L/VI:L) with no confirmed scope change to underlying OS or adjacent systems (SC:N).

The CVSS 4.0 base score of 2.1 is atypically low for a SQL injection, which warrants explanation. The vector AV:N/AC:L/AT:N/PR:L/UI:N confirms network-accessible exploitation with no complexity or user interaction, but the impact metrics are all Low (VC:L/VI:L/VA:L) with no lateral scope change (SC:N/SI:N/SA:N), indicating the SQL injection does not yield full database dump capability or administrative takeover in standard testing. The E:P modifier confirms a proof-of-concept exploit exists, which elevates urgency above a purely theoretical finding. No EPSS score was provided in the input data, so probability of mass exploitation cannot be quantified. CISA KEV status is absent, consistent with a small-footprint, niche academic management tool unlikely to attract nation-state or ransomware operators. The realistic risk profile is low-to-moderate: the exploit requires authenticated access (PR:L), is limited to a small-market PHP application, and impact per the CVSS is constrained - however, any SQL injection in an admin panel managing student records carries non-trivial data privacy implications beyond what the CVSS score alone conveys.

An attacker who has obtained low-privilege credentials to the CodeAstro admin panel sends a crafted HTTP GET or POST request to /attendance-php/Admin/createClass.php?action=edit with a malicious value in the ID parameter (e.g., appending SQL syntax such as ' OR 1=1-- or a UNION SELECT clause). The application passes this unsanitized input directly to the database query, allowing extraction of table contents or modification of records. A public proof-of-concept demonstrating this technique is referenced at https://github.com/Andelstander/cve/issues/9.