CVE-2026-11582: CodeAstro Student Attendance Management System index.php sql injection
A flaw has been found in CodeAstro Student Attendance Management System 1.0. The impacted element is an unknown function of the file /attendance-php/index.php. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
CodeAstro Student Attendance Management System 1.0from your environment.If the application is not required or cannot be adequately mitigated, uninstall or remove the CodeAstro Student Attendance Management System 1.0 (or disable the attendance module) until an official fix is released.
- Configuration
Disable or restrict access to the /attendance-php/index.php endpoint (for example via web server ACLs, virtual host configuration, or application configuration) until a secure code-level fix is available.
CodeAstro Student Attendance Management System access to /attendance-php/index.php = restricted or disabled - Compensating control
Apply a web application firewall (WAF) or IPS rule to block SQL injection attempts targeting the Username parameter and the /attendance-php/index.php endpoint. If a WAF is not available, restrict access to the application (or that endpoint) at the network perimeter to trusted IP addresses only.
- Operational
Assume potential exploitation (exploit published). Review web and application logs for suspicious activity targeting the Username parameter or /attendance-php/index.php, rotate any credentials or secrets that may have been exposed, and restore affected systems from known-good backups if compromise is detected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11582?
The severity of CVE-2026-11582 is medium, rated at 5.5.
How can I fix CVE-2026-11582?
To fix CVE-2026-11582, ensure to validate and sanitize user inputs in the index.php file to prevent SQL injection.
What type of vulnerability is found in CVE-2026-11582?
CVE-2026-11582 is an SQL injection vulnerability that allows attackers to manipulate database queries.
Can CVE-2026-11582 be exploited remotely?
Yes, CVE-2026-11582 can be exploited remotely by manipulating the Username argument in the affected system.
What is the risk rating for CVE-2026-11582?
The risk rating for CVE-2026-11582 is 52, indicating a moderate risk concern.