Authentication bypass via unsanitized username query

SQL injection in Student Attendance Management System 1 allows remote attackers to bypass login via a crafted username at index.php. The login handler inserts the submitted username directly into SELECT queries for administrator or class-teacher accounts without parameter binding or escaping. Access to the unauthenticated login form is sufficient; a successful injection changes authentication-query logic and grants the selected account role.