This vulnerability involves an SQL injection in the CodeAstro Student Attendance Management System 1.0, specifically in the createClass.php script under the Admin directory. The className argument is vulnerable to injection, enabling an attacker to manipulate backend SQL queries. The vulnerability can be triggered remotely without authentication or user interaction, increasing its risk. The CVSS 4.0 base score is 5.3, indicating a medium severity level. No official fix or patch has been published by the vendor, and the product is not a cloud service, so remediation depends on the vendor or user applying custom mitigations.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. Given the medium CVSS score and low attack complexity, the vulnerability poses a moderate risk to confidentiality and integrity of the affected system's data. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is available, users should consider implementing input validation or parameterized queries as a temporary mitigation. Monitoring for unusual database activity related to the vulnerable parameter is also advisable until an official fix is released.