A missing authentication check in the create_admin.php component allows an attacker to manipulate the e parameter and create a new administrator account without any credentials. By exploiting this flaw, the attacker gains full control over the application, enabling data theft, unauthorized data modification, and potentially denial of service if the attacker chooses to lock legitimate users out. The vulnerability directly affects the integrity, confidentiality, and availability of the system.

SourceCodester Smart Attendance System with QR Code Scanner, version 1.0, distributed by SourceCodester, is affected. No other versions are listed in the advisory.

The vulnerability has a CVSS score of 6.9, indicating moderate severity. The EPSS score is not available, so exact exploitation likelihood cannot be quantified, but the lack of authentication checks makes remote exploitation straightforward. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote HTTP request to the create_admin.php endpoint, requiring no special privileges or services beyond network connectivity.