The Student Attendance Management System v1 is vulnerable to unauthenticated SQL injection attacks, which could lead to complete system compromise.

This is a SQL injection vulnerability located within the createStudents.php file. The application fails to properly sanitize user-supplied input in the Id, firstname, and admissionNumber parameters, allowing an unauthenticated attacker to manipulate backend database queries.

The ability to execute arbitrary SQL commands allows an attacker to extract sensitive student data, modify records, or potentially gain administrative access to the underlying database. Given the CVSS score of 8.8, this vulnerability is classified as High severity, posing a significant risk to data confidentiality, integrity, and availability.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected script or take the application offline until a secure version is released.

Proactive Monitoring: Review database audit logs for anomalous query patterns, particularly those containing SQL syntax characters or unexpected administrative commands.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious traffic targeting the vulnerable parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub Gist referenced by the researcher.

Due to the severity of this SQL injection vulnerability and the availability of technical details for exploitation, immediate action is required. Organizations using this software should prioritize limiting exposure by disabling the affected functionality or placing the system behind robust defensive controls until a vendor-supplied patch is deployed.