Qr Code Attendance Management System
Monthly
Authenticated privilege escalation in CodeAstro QR Code Attendance Management System 1.0 lets a logged-in, low-privileged user manipulate the role_id argument in the UserController Save action to assign elevated roles, up to administrator, to any account they control. The flaw is an improper privilege management weakness (CWE-269) exposed through the PHP web interface, and publicly available exploit code exists (a GitHub proof-of-concept), though there is no CISA KEV entry confirming active exploitation. Severity is modest and consistent with the raw numbers: vendor CVSS 5.1 with low confidentiality, integrity and availability impact, and independently assessed as requiring an authenticated session (PR:L) against this single, obscure application at version 1.0.
Authenticated privilege escalation in CodeAstro QR Code Attendance Management System 1.0 lets a logged-in, low-privileged user manipulate the role_id argument in the UserController Save action to assign elevated roles, up to administrator, to any account they control. The flaw is an improper privilege management weakness (CWE-269) exposed through the PHP web interface, and publicly available exploit code exists (a GitHub proof-of-concept), though there is no CISA KEV entry confirming active exploitation. Severity is modest and consistent with the raw numbers: vendor CVSS 5.1 with low confidentiality, integrity and availability impact, and independently assessed as requiring an authenticated session (PR:L) against this single, obscure application at version 1.0.