What is the CVSS score of CVE-2026-37749?

CVE-2026-37749 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-37749?

CodeAstro Simple Attendance Management System v1.0 contains a critical SQL injection vulnerability in the authentication mechanism that allows unauthenticated remote attackers to completely bypass…

How to fix or mitigate CVE-2026-37749?

Within 24 hours: Immediately isolate all CodeAstro v1.0 instances from production networks or take them offline; inventory all systems running this product and affected data scope. Within 7 days: Evaluate and implement alternative attendance management solutions; if continued use is unavoidable, deploy network-level access controls (WAF rules blocking SQL metacharacters in username fields, network segmentation). Within 30 days: Complete migration to patched or alternative software; document lessons learned and implement input validation testing in vendor selection criteria.

PHP CVE-2026-37749

EUVD-2026-23440 CRITICAL

SQL Injection (CWE-89)

2026-04-17 mitre

GHSA-h6m6-2qjp-9v82

PHP SQLi N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 17, 2026 - 17:32 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 15:15 euvd

EUVD-2026-23440

Analysis Generated

Apr 17, 2026 - 15:15 vuln.today

CVE Published

Apr 17, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attackers to bypass authentication via the username parameter in index.php.

Articles & Coverage 1

medium.com CVE-2026-37749: SQL Injection Authentication Bypass via Login Form Apr 18, 2026

AnalysisAI

SQL injection in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attackers to bypass authentication via the username parameter in index.php. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicates trivial exploitation. CISA SSVC framework confirms proof-of-concept exists, attack is automatable, and technical impact is total (full system compromise). Public POC available on GitHub enables immediate weaponization by attackers with no specialized skills.

Technical ContextAI

This is a classic SQL injection (CWE-89) in a PHP-based authentication mechanism. The vulnerability exists in the login form of CodeAstro Simple Attendance Management System v1.0, where the username parameter in index.php lacks proper input validation and sanitization before being used in SQL queries. Attackers can inject malicious SQL syntax to manipulate the authentication query logic, typically using techniques like ' OR '1'='1 to always evaluate to true. The affected product is a small-scale PHP application for tracking employee/student attendance, often deployed in educational institutions or small businesses. The SQLi occurs at the application's entry point (login page), making it the most critical attack surface. No specific database backend is mentioned, but PHP applications of this class typically use MySQL/MariaDB.

RemediationAI

No vendor-released patch has been identified at time of analysis - CodeAstro has not published a fixed version or security advisory. Organizations running this system must implement immediate compensating controls: (1) Remove the application from internet-facing servers and restrict access to trusted internal networks only via firewall rules or VPN; (2) Implement a Web Application Firewall (WAF) with SQL injection signatures to block malicious payloads in the username parameter, though determined attackers may bypass signature-based detection; (3) Apply input validation by modifying index.php to use parameterized queries (prepared statements) with mysqli or PDO, escaping all user inputs - this requires code modification expertise and thorough testing as changes may break login functionality; (4) Monitor authentication logs for suspicious patterns like repeated login attempts with special characters (', --, OR, UNION). Long-term recommendation is to migrate to actively maintained authentication systems with security-focused development practices, as this application appears to be an unsupported code sample rather than a commercially supported product.