A critical SQL injection vulnerability in Student Attendance Management System v1 allows unauthenticated attackers to potentially compromise the underlying database.

The application fails to properly sanitize user input provided to the emailAddress parameter of the createClassTeacher.php script, which allows for SQL injection. Based on the CVSS vector, this vulnerability can be triggered by an unauthenticated attacker.

The ability to perform SQL injection allows an attacker to manipulate database queries, potentially leading to unauthorized data exfiltration, modification, or complete deletion of records. Given the CVSS score of 8.8, this vulnerability poses a high risk to the confidentiality, integrity, and availability of student and teacher data managed by the system.

Immediate Action: As no official vendor patch is currently identified, administrators should restrict access to the affected web interface or disable the application until a fix is released.

Proactive Monitoring: Review database query logs for unusual syntax or patterns associated with SQL injection attempts, such as unexpected characters or unexpected table access.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application interface.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub Gist reference.

The severity of this flaw necessitates immediate attention to prevent unauthorized database access. Since an official patch is not confirmed, organizations relying on this software should isolate the system from public networks or implement strict input validation at the WAF level until the vendor provides a secure update.