CVE-2026-11582
Received Received - Intake
SQL Injection in CodeAstro Student Attendance Management System

Publication date: 2026-06-08

Last updated on: 2026-06-08

Assigner: VulDB

Description
A flaw has been found in CodeAstro Student Attendance Management System 1.0. The impacted element is an unknown function of the file /attendance-php/index.php. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-08
Last Modified
2026-06-08
Generated
2026-06-09
AI Q&A
2026-06-08
EPSS Evaluated
N/A
NVD
CVE-2026-11582
EUVD
EUVD-2026-35190
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
codeastro student_attendance_management_system 1.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a flaw found in the CodeAstro Student Attendance Management System version 1.0. It exists in an unknown function within the file /attendance-php/index.php. The issue arises from improper handling of the 'Username' argument, which can be manipulated to perform an SQL injection attack. This means an attacker can inject malicious SQL code remotely to interfere with the database operations.

Impact Analysis

The vulnerability can have serious impacts as it allows remote attackers to perform SQL injection by manipulating the Username parameter. This can lead to unauthorized access to or modification of the database, potentially compromising the confidentiality, integrity, and availability of the system's data. Attackers might be able to read sensitive information, alter records, or disrupt the attendance management system's operations.

Compliance Impact

The SQL injection vulnerability in CodeAstro Student Attendance Management System 1.0 can lead to unauthorized database access, data leakage, and tampering. Such security breaches can result in exposure of sensitive personal data, which may violate data protection regulations like GDPR and HIPAA that require safeguarding personal and health information.

Failure to protect against this vulnerability could lead to non-compliance with these standards due to inadequate data security controls, potentially resulting in legal and financial consequences.

Detection Guidance

The vulnerability can be detected by testing the 'username' parameter in the /attendance-php/index.php file for SQL injection flaws.

One common method is to use automated tools such as sqlmap to test for SQL injection vulnerabilities.

  • Run sqlmap against the target URL with the username parameter, for example: sqlmap -u "http://target/attendance-php/index.php?username=test" --batch
  • Manually test by injecting SQL payloads into the username parameter and observing the response for errors or unexpected behavior.
Mitigation Strategies

Immediate mitigation steps include implementing prepared statements to handle database queries safely.

Strict input validation should be applied to the username parameter to prevent malicious input.

Minimize database permissions to limit the impact of a potential SQL injection attack.

Conduct regular security audits to identify and fix similar vulnerabilities.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart