This vulnerability in CodeAstro Student Attendance Management System 1.0 allows remote attackers to perform SQL injection by manipulating the Username parameter in a function within /attendance-php/index.php. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating it is exploitable over the network without privileges or user interaction, with low to limited impact on confidentiality, integrity, and availability. No official fix or mitigation has been disclosed by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited scope and impact metrics in the CVSS vector. There are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall rules to detect and block malicious SQL injection attempts targeting the Username parameter. Monitor vendor channels for updates and patches.