A SQL injection flaw exists in the username input of the index.php page of the CodeAstro Simple Attendance Management System. The attacker can supply crafted input that modifies the underlying SQL query, allowing them to bypass the login check and authenticate as any user or gain full application access. This leads to a complete loss of confidentiality, integrity, and availability for the system and the data it manages.

The vulnerability affects the CodeAstro Simple Attendance Management System, specifically version 1.0. No other product versions or vendors are listed in the available data.

The CVSS score of 9.8 indicates a very high severity, and the lack of an EPSS score prevents precise quantitative assessment of exploitation probability. The remote, unauthenticated nature of the exploit and its ability to grant unrestricted access indicate that the attacker can gain full application control. Because the attack vector requires only a standard HTTP request to the vulnerable script, it can be performed from any external network without requiring local privileges. As the vulnerability is already publicly documented, exploitation could be readily automated by attackers if a patch is not applied promptly.