The flaw exists in the /addnewfaculty endpoint of CodeAstro Online Classroom 1.0. By manipulating the fname argument, an attacker can inject arbitrary SQL statements, potentially altering, exposing, or deleting data stored in the database. The vulnerability is exploitable remotely and, based on the description, it is inferred that an external attacker can trigger the injection without any prior authentication.

This issue impacts the CodeAstro Online Classroom application, version 1.0. Administrators should verify that their deployment is not running this vulnerable build and consider upgrading if a newer, patched release is available.

The CVSS score of 5.3 classifies the threat as moderate, but EPSS data is not provided and the vulnerability is not included in CISA KEV. Nevertheless, a published exploit and the remote nature of the attack indicate that attackers could aim at unsuspecting installations. The problem is tied to input handling weaknesses (CWE-74 and CWE-89), allowing unauthenticated attackers to execute arbitrary SQL code.