A flaw exists in CodeAstro Online Classroom 1.0 where the deleteid parameter within addassessment.php is incorporated into an SQL statement without proper sanitization, creating a classic SQL injection opportunity. An attacker can remotely craft a request that manipulates deleteid to execute arbitrary SQL commands. This can lead to unauthorized data exposure, data tampering, or even database compromise, consistent with the weaknesses identified as CWE‑74 and CWE‑89.

The vulnerability affects the CodeAstro Online Classroom product, specifically the addassessment.php component of the Parameter Handler. The affected release is 1.0; no other versions are listed in the advisory.

The CVSS base score is 5.3, indicating a moderate severity. No EPSS score is published, and the issue is not listed in the CISA KEV catalog, but the public nature of the exploit and the ability to execute the attack remotely increase its real‑world risk. An adversary could leverage this weakness to gain further insight into the application’s database structure and potentially extract sensitive data.