The vulnerability resides in the deleteid parameter of the /guestdetails endpoint in CodeAstro Online Classroom 1.0. By manipulating this parameter, an attacker can inject arbitrary SQL statements. This allows unauthorized modification, exfiltration, or destruction of data stored in the application database. The flaw is a classic input validation weakness (CWE‑74) that can lead to a full SQL injection (CWE‑89). The potential consequences include loss of data integrity, confidentiality breaches, and possible escalation to a database compromise, depending on the privileges granted to the affected user.

CodeAstro Online Classroom, version 1.0, includes a guestdetails page that processes a deleteid query parameter without proper sanitization. No other versions or configurations are specifically listed.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The description states the attack can be performed from remote, suggesting that any outsider with network access to the application can trigger the exploit. Publicly disclosed exploits exist, and no authentication requirement is mentioned, so the risk is amplified for publicly accessible deployments.