The vulnerability exists in CodeAstro Online Classroom 1.0 through the Parameter Handler in the file updatedetailsfromfaculty.php. Input from the argument fname is not properly sanitized, allowing an attacker to inject arbitrary SQL statements. An attacker exploiting this flaw could read, modify, or delete database contents, potentially exposing sensitive user data or disrupting service operation.

This issue affects CodeAstro’s Online Classroom product, specifically the Parameter Handler component in updatedetailsfromfaculty.php. The reported affected version is 1.0. No additional version details are supplied, so any instance that includes this component may be vulnerable.

The CVSS base score of 5.3 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation. The attack can be carried out remotely by submitting a crafted fname parameter in the request URL. Because the flaw is publicly disclosed, unauthenticated users may be able to exploit it if the file is reachable from the internet.