Attendance Management System using PHP with Source Code

Submitted by razormist on Friday, February 5, 2021 - 10:22.

Language

The Attendance Management System with Source Code is a PHP project that can maintain daily attendance records easily and conveniently. This system was created using PHP, HTML, MYSQLi, and Javascript.

This application is easy to use, the user has access to all data that is related to student information. You can view the details and add some new information for courses, units, etc. The system data/lists can be printed and exported to CSV, Excel, and PDF. The administrator can manipulate the information and also maintain the security of the system. Database backups can also be generated through admin permission.

Features

Manage Courses
Manage Units
Manage Student
Manage Attendance
Manage Website Settings
Manage User Accounts
Manage User Groups

How to Run

Requirements

Download and Install any local web server such as XAMPP/WAMP.
Download and Extract the source code zip file.

Installation

Open the XAMPP/WAMP's Control Panel and start "Apache" and "MySQL".
If you are using XAMPP, copy the extracted folder and paste it into the XAMPP's "htdocs" directory. If you are using WAMP, paste it into the "www" directory.
Locate the SQL file in the extracted source code folder. The SQL file is known as "attendance_management.sql" and located inside the "db" folder.
Open a web browser and browse the PHPMyAdmin. (http://localhost/phpmyadmin)
Create a new database naming "attendance_management".
Import the SQL file to your newly created database.
Open a web browser and browse the web application. (http://localhost/Attendance%20Management%20System/)

Admin Access

Username: admin
Password: admin

Demo

That's it! I hope that this system can help you with what you are looking for. For more updates and tutorials just kindly visit this site.

Enjoy Coding!!

Note: Due to the size or complexity of this submission, the author has submitted it as a .zip file to shorten your download time. After downloading it, you will need a program like Winzip to decompress it.

Virus note: All files are scanned once-a-day by SourceCodester.com for viruses, but new viruses come out every day, so no prevention program can catch 100% of them.

FOR YOUR OWN SAFETY, PLEASE:

1. Re-scan downloaded files using your personal virus checker before using it.
2. NEVER, EVER run compiled files (.exe's, .ocx's, .dll's etc.)--only run source code.

Comments

SQL injections

Some values can pass the sanitizer function then there are many SQL injections in the project. The sanitizer function called makeSafe in file admin/incFunctions.php The value can pass the function is "\\\\'\\\\\\'or 1=1; -- " Code example to pass the function:


connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

//$x = $_GET['p1'];
$x = "\\\\'\\\\\\'or 1=1; -- ";

if(makeSafe($x) == false){
    exit("false");
}

$sql = "SELECT id, first, last FROM person where first = '$x'; ";
$result = $conn->query($sql);

if ($result->num_rows > 0) {
    // output data of each row
    while($row = $result->fetch_assoc()) {
        echo "
 id: ". $row["id"]. " - Name: ". $row["first"]. " " . $row["last"] . "
";
    }
} else {
    echo "0 results";
}

$conn->close();

CVE assigned

CVE-2021-44280 is assigned. attendance management system 1.0 is affected by a SQL injection vulnerability in admin/incFunctions.php through the makeSafe function.

SQL injections

Update the previous comment. The value that can pass the sanitizer is $x = "\\'\\\'or 1=1; -- ";

Arbitrary file deletion vulnerability

http://127.0.0.1:8887/admin/pageUploadCSV.php?action=delect_csv&csv=xxx Arbitrary file deletion vulnerability exists： Since "get_csv" does not filter the received CSV parameters, "delete_csv" is directly called to cause arbitrary files. The specific code is as follows: ---------------------------------------------------------------------------------------------------------------------------------------------------------- protected function get_csv($options = array()){ $csv_ok = true; $csv = $this->request['csv']; if(!$csv) $csv_ok = false; if($csv_ok){ $csv = basename($csv); if(!is_readable("{$this->curr_dir}/csv/{$csv}")) $csv_ok = false; } if(!$csv_ok){ if(isset($options['htmlpage'])){ echo $this->header(); echo errorMsg($this->lang['csv file upload error'] . $this->error_back_link . $this->debug(__LINE__)); echo $this->footer(); } return false; } return $csv; } public function delete_csv(){ $deleted = false; @header('Content-type: application/json'); $csv_folder = "{$this->curr_dir}/csv/"; $csv = $this->get_csv(); if($csv && @unlink($csv_folder . $csv)) $deleted = true; echo json_encode(array('deleted' => $deleted)); }

Hello, can I apply for CVE?

Add new comment

Add new comment
35966 views