CVE-2026-37749 Details

A SQL injection vulnerability has been identified in CodeAstro Simple Attendance Management System version 1.0. This vulnerability allows remote, unauthenticated attackers to bypass authentication by exploiting the username parameter in the login form of index.php. The vulnerability arises because the application concatenates the username directly into a MySQL query without proper sanitization or the use of prepared statements. As a result, an attacker can inject a crafted SQL payload to gain unauthorized access.

To address this vulnerability, update the SQL query in index.php to use prepared statements instead of concatenating user input directly into the query. This can be done using the MySQLi or PDO extension, which provide methods for safely binding parameters and executing queries.