CVE-2026-11585: CodeAstro Student Attendance Management System createClassArms.php sql injection
A vulnerability was determined in CodeAstro Student Attendance Management System 1.0. Affected is an unknown function of the file /attendance-php/Admin/createClassArms.php. This manipulation of the argument classId causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
CodeAstro Student Attendance Management System (/attendance-php/Admin/createClassArms.php)from your environment.If the createClassArms.php functionality is not required, remove or disable the file/endpoint to eliminate the vulnerable code path.
- Configuration
Modify /attendance-php/Admin/createClassArms.php to validate and sanitize the classId parameter and to use prepared statements/parameterized queries (or an ORM with parameterization) instead of concatenating user input into SQL to prevent SQL injection.
CodeAstro Student Attendance Management System (/attendance-php/Admin/createClassArms.php) classId input handling = validate and sanitize input; use parameterized queries - Compensating control
Until code is fixed, restrict access to the admin endpoint /attendance-php/Admin/createClassArms.php (and the admin interface) to trusted IP addresses or internal networks using a firewall, VPN, or Web Application Firewall to prevent remote exploitation.
- Operational
Assume possible exploitation where the vulnerability was exposed: review application and web server logs for suspicious activity, investigate for indicators of compromise, and rotate any credentials or API keys that may have been used or exposed prior to applying the fix.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11585?
The severity of CVE-2026-11585 is medium with a score of 6.3.
What is CVE-2026-11585?
CVE-2026-11585 refers to a SQL injection vulnerability found in the CodeAstro Student Attendance Management System affecting the createClassArms.php file.
How does CVE-2026-11585 affect systems?
CVE-2026-11585 allows remote attackers to execute arbitrary SQL commands through manipulation of the classId parameter.
How do I fix CVE-2026-11585?
To fix CVE-2026-11585, sanitize and validate user inputs to the classId parameter in the createClassArms.php file.
What systems are affected by CVE-2026-11585?
CVE-2026-11585 affects CodeAstro Student Attendance Management System version 1.0.