CVE-2026-12175: CodeAstro Student Attendance Management System createStudents.php sql injection
A vulnerability was detected in CodeAstro Student Attendance Management System 1.0. Impacted is an unknown function of the file /attendance-php/Admin/createStudents.php. Performing a manipulation of the argument admissionNumber results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
CodeAstro Student Attendance Management System 1.0from your environment.Uninstall or take the vulnerable CodeAstro Student Attendance Management System 1.0 instance offline if it is not required or until a secure patch/fix is available.
- Configuration
Modify /attendance-php/Admin/createStudents.php to eliminate SQL injection: use prepared statements/parameterized queries for any database calls that use admissionNumber and implement strict input validation and sanitization (reject unexpected characters/lengths) before use.
CodeAstro Student Attendance Management System createStudents.php admissionNumber input handling = use parameterized queries; validate and sanitize input - Compensating control
Block or restrict access to the affected endpoint (/attendance-php/Admin/createStudents.php) at the network perimeter (firewall, WAF, or reverse proxy) or limit access to trusted IPs/users until the vulnerability is remediated.
- Operational
Assume possible exploitation due to public proof-of-concept: review application and access logs for suspicious activity, rotate any database credentials or application secrets that may have been exposed, and restore affected components from known-good backups if compromise is confirmed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12175?
CVE-2026-12175 has a severity rating of medium, with a score of 4.7.
How do I fix CVE-2026-12175?
To fix CVE-2026-12175, sanitize and validate all user inputs, particularly the admissionNumber parameter in createStudents.php to prevent SQL injection.
What type of attack is associated with CVE-2026-12175?
CVE-2026-12175 is associated with an SQL injection attack that targets the CodeAstro Student Attendance Management System.
Who is affected by CVE-2026-12175?
Anyone using CodeAstro Student Attendance Management System version 1.0 is potentially affected by CVE-2026-12175.
Can CVE-2026-12175 be exploited remotely?
Yes, CVE-2026-12175 allows for remote exploitation due to the SQL injection vulnerability.