A flaw exists in the CodeAstro Online Classroom application, specifically within the takeassessment2.php script. By manipulating the Q1 parameter in the request, an attacker can inject arbitrary SQL commands. This injection allows the modification or retrieval of data stored in the system’s database, potentially exposing sensitive information and allowing further exploitation. The vulnerability is actionable from a remote web interface, meaning an attacker does not need local access.

The affected product is CodeAstro Online Classroom, identified by the CNA as CodeAstro:Online Classroom. The vulnerability is present in the 1.0/2.php release and is triggered when accessing /OnlineClassroom/takeassessment2.php with a valid exid value such as 14. No other specific product versions are listed as affected in the available data.

The CVSS score of 5.3 indicates a medium severity risk. EPSS data is not available, and the flaw is not recorded in the CISA KEV catalog. An attacker can reach the vulnerable endpoint remotely over HTTP or HTTPS, and publicly available exploit code confirms that exploitation is straightforward. Consequently, organizations running this version should consider the risk moderate to high, especially if sensitive student or academic data is stored in the database.