A vulnerability exists in the delete-jobs.php script of the CodeAstro Online Job Portal that allows malicious actors to manipulate the ID parameter, resulting in a classic SQL injection flaw. This flaw can grant unauthorized database access and enable the attacker to read, modify, or delete job posting records, thereby compromising the confidentiality, integrity, and availability of the portal’s data.

The affected product is CodeAstro Online Job Portal version 1.0. No other versions or vendor variants are listed, so any deployment of this version should be considered vulnerable.

The CVSS score of 6.9 indicates a moderate severity level, and the EPSS score is not available, but the vulnerability is an active remote vulnerability with a publicly available exploit. The flaw is exploitable over the network via the web interface, and an attacker could leverage the SQL injection to compromise the underlying database. Although the vulnerability is not currently listed in the CISA KEV catalog, its remote nature and public exploit increase its risk to deployments that have not applied a fix.