A vulnerability exists in the admin interface of CodeAstro Online Job Portal that allows an attacker to manipulate the ID parameter in the delete-jobs.php endpoint. The flaw enables supplied values to be inserted directly into a database query, which can result in arbitrary SQL code execution. The primary consequence is the ability to delete or alter job listings and, depending on database permissions, potentially extract or modify other stored information. This weakness is identified as typical of CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

The affected product is the CodeAstro Online Job Portal, version 1.0. The vulnerable component is the All Jobs Page located in the /admin/jobs-admins/delete-jobs.php file. Current version and patch status are not provided, so any installation of version 1.0 without additional security controls is considered affected.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is reported as below 1%, suggesting that the probability of exploitation is low but non-zero. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, via web-based interaction, and the exploit has been publicly released, meaning attackers could launch an attack simply by sending a crafted HTTP request to the vulnerable endpoint.