A critical SQL injection vulnerability in Student Attendance Management System v1 exposes the application to unauthorized database access and potential remote command execution.

The application fails to properly sanitize input parameters id, termId, and sessionName within the createSessionTerm.php script. This flaw allows an unauthenticated attacker to inject malicious SQL commands to compromise the backend database.

The vulnerability carries a CVSS score of 8.8, indicating a high severity risk that could lead to full database compromise, data exfiltration, or total loss of system integrity. Successful exploitation may result in unauthorized access to student records, administrative credentials, and other sensitive information, causing significant reputational and operational damage.

Immediate Action: Since no official vendor patch is currently available, administrators should restrict network access to the affected script or disable the vulnerable module entirely until a fix is released.

Proactive Monitoring: Security teams should monitor database logs for anomalous queries, syntax errors, or unexpected administrative actions originating from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious input targeting the createSessionTerm.php file.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the provided GitHub Gist reference.

Given the high severity and the availability of public technical details, this vulnerability poses an elevated risk to any organization running this software. Administrators must prioritize the implementation of compensating controls such as WAF rules and network isolation to protect the backend database from unauthorized manipulation until an official security update is provided by the vendor.