The vulnerability exists in the createClass.php script of CodeAstro Student Attendance Management System v1.0. The className parameter is concatenated directly into an SQL query without validation, creating an injection point. An attacker can supply a crafted className value to execute arbitrary SQL commands, exposing or altering attendance data. The flaw permits remote exploitation, meaning it can be triggered from outside the host.

CodeAstro Student Attendance Management System, version 1.0. The issue resides in the /attendance-php/Admin/createClass.php file of this version. No other product or version information is noted.

The CVSS score of 5.3 classifies the vulnerability as medium severity. EPSS is not reported and the flaw is not listed in CISA KEV. Because the description states that the attack can be initiated remotely and does not require authentication, any user able to reach the className endpoint can potentially inject SQL. Successful exploitation could lead to unauthorized reading, modification, or deletion of attendance records, compromising the confidentiality and integrity of the data without implying availability impact based on the supplied data.