A SQL injection flaw exists in the createClassArms.php script of CodeAstro Student Attendance Management System. By manipulating the classId argument, an attacker can inject arbitrary SQL statements. The vulnerability is able to be triggered remotely and the malicious input can lead to the disclosure, modification, or deletion of data stored in the system’s database. The flaw directly maps to input validation weaknesses (CWE‑74) and unsanitized query construction (CWE‑89).

The affected product is CodeAstro Student Attendance Management System version 1.0. All deployments of this version that expose the /attendance-php/Admin/createClassArms.php endpoint are vulnerable.

The CVSS score of 5.3 indicates a medium severity impact. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so no compelling evidence of widespread exploitation exists yet. However, the flaw is remediable via an update and can be exploited by any remote user with the proper URL and credentials. The risk remains that unpatched systems could be compromised by attackers who discover the publicly disclosed exploit.