The Simple Attendance Record System 2.0 is vulnerable to an unauthenticated SQL injection attack that could allow unauthorized database interaction.

This vulnerability is a SQL injection (CWE-89) located in the check.php file. An unauthenticated attacker can supply a malicious payload via the student parameter, which is concatenated directly into a database query without validation.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands against the backend database. This may lead to the unauthorized disclosure of sensitive student records, modification of attendance data, or potential compromise of the database server. With a CVSS score of 7.3, this represents a high-severity risk that could lead to significant data integrity loss and potential system-wide compromise.

Immediate Action: As no official patch is available, administrators should immediately restrict access to the affected web application or take it offline until the vendor releases a security update.

Proactive Monitoring: Monitor server access logs for anomalous HTTP POST requests to check.php containing SQL-related characters or suspicious string patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in incoming requests to the student parameter.

Public Exploit Available: Yes, a public proof-of-concept is available via the researcher write-up published on GitHub.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses an immediate risk to any deployment of the Simple Attendance Record System 2.0. Organizations should prioritize isolating the affected component and implementing robust input validation or WAF protections to mitigate the risk until an official patch is provided by the vendor.