A critical SQL injection vulnerability in CodeAstro Simple Attendance Management System allows unauthenticated attackers to bypass authentication and potentially gain full control of the application.

The application fails to properly sanitize user input in the username parameter within index.php, permitting SQL injection. This flaw allows an unauthenticated attacker to manipulate database queries to bypass authentication mechanisms.

A successful exploit allows an unauthenticated attacker to bypass administrative login screens, potentially gaining full access to sensitive attendance records and system settings. Given the CVSS score of 9.8, this vulnerability allows for complete compromise of the application, leading to significant data exposure and loss of system integrity.

Immediate Action: As there is no official patch mentioned, users should immediately restrict access to the application via network-level controls or disable the service until a secure version is released.

Proactive Monitoring: Monitor database query logs for suspicious SQL syntax, such as UNION SELECT statements or attempts to manipulate query logic via the username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns targeting common login parameters.

Public Exploit Available: Yes — a public repository exists on GitHub (menevarad007/CVE-2026-37749).

The lack of a vendor-provided patch combined with the availability of a public proof-of-concept makes this a high-risk scenario. Organizations currently running this software should consider it compromised if exposed to the internet and take immediate steps to isolate or decommission the instance until a permanent fix is verified.