The identified weakness allows an attacker to inject arbitrary SQL statements by manipulating the fname argument in the updatedetailsfromstudent.php endpoint. Because the vulnerability exists in a publicly accessible web page, a remote adversary can craft a malicious request without authentication and potentially retrieve sensitive educational data or alter classroom records. The severity score indicates a moderate risk to the integrity and confidentiality of the system’s database.

This issue affects the CodeAstro Online Classroom application, specifically version 1.0. No other product or vendor versions are listed as impacted.

A CVSS score of 5.3 indicates moderate severity, and the vulnerability is publicly disclosed with no known EPSS score or KEV listing. The most likely exploitation path involves sending a crafted HTTP GET request to the updatedetailsfromstudent.php page containing a payload in the fname parameter. Without mitigation, unauthorized actors could execute the injection without needing elevated privileges or additional access.