CVE-2026-11584: CodeAstro Student Attendance Management System createClass.php edit sql injection
A vulnerability was found in CodeAstro Student Attendance Management System 1.0. This impacts an unknown function of the file /attendance-php/Admin/createClass.php?action=edit. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
CodeAstro Student Attendance Management System 1.0from your environment.If the application is not required, uninstall or take CodeAstro Student Attendance Management System 1.0 offline until a vendor-supplied fix is available.
- Configuration
Temporarily disable or restrict HTTP access to /attendance-php/Admin/createClass.php?action=edit (for example remove the file from web root, deny access in webserver configuration, or restrict access by IP) until a secure patch or fix is available.
CodeAstro Student Attendance Management System (createClass.php) /attendance-php/Admin/createClass.php?action=edit access = disabled or restricted to trusted IPs - Compensating control
Deploy a web application firewall (WAF) or IPS rule to detect and block SQL injection attempts targeting the ID parameter (and similar parameters) on /attendance-php/Admin/createClass.php?action=edit and other admin endpoints.
- Compensating control
Restrict access to the administration area (including /attendance-php/Admin/) at the network/firewall level to known/trusted management IP addresses only.
- Operational
Review web server and application logs for signs of exploitation of /attendance-php/Admin/createClass.php?action=edit. If any suspicious activity is found or compromise is suspected, rotate database and administrative credentials and restore affected components from known-good backups.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11584?
The severity of CVE-2026-11584 is classified as medium with a score of 6.3.
How do I fix CVE-2026-11584?
To fix CVE-2026-11584, you should implement input validation and parameterized queries in the affected SQL functions.
What does CVE-2026-11584 affect?
CVE-2026-11584 affects the CodeAstro Student Attendance Management System, specifically the createClass.php file during the edit action.
Can CVE-2026-11584 be exploited remotely?
Yes, CVE-2026-11584 can be exploited remotely by manipulating the vulnerable SQL query.
What type of vulnerability is CVE-2026-11584?
CVE-2026-11584 is an SQL Injection vulnerability that allows attackers to manipulate SQL queries.