CVE-2026-7741

CodeAstro Online Classroom studentlogin sql injection

View on CVE.org
Published May 4, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in CodeAstro Online Classroom 1.0. Impacted is an unknown function of the file /OnlineClassroom/studentlogin. Performing a manipulation of the argument sid results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

Analysis

AI-generated

Technical impact

The vulnerability is a classic SQL injection in the studentlogin endpoint of CodeAstro Online Classroom 1.0. By manipulating the sid parameter, an attacker can inject arbitrary SQL commands, potentially reading, modifying, or deleting student data stored in the database. The flaw resides in a publicly accessible endpoint, enabling remote attackers to exploit it without needing authentication, and a public exploit is already available on GitHub and in vulnerability databases.

Affected Systems

CodeAstro Online Classroom 1.0 is affected. The flaw exists in the /OnlineClassroom/studentlogin endpoint, and no other product versions are currently listed as vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity level. While the EPSS score is not available, the remote nature of the attack vector and the existence of a public exploit suggest that the vulnerability presents a realistic threat. The vulnerability has not been listed in CISA KEV, but the potential for unauthorized access to sensitive student data warrants prompt action.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available official patch or upgrade for CodeAstro Online Classroom 1.0 that fixes the SQL injection in the studentlogin endpoint.
  • If a patch is not available, refactor the application to use parameterized queries or prepared statements for interactions involving the sid parameter, ensuring that user input cannot alter the SQL structure.
  • Deploy a web application firewall or intrusion detection system configured to block common SQL injection payloads against the /OnlineClassroom/studentlogin endpoint while a patch is pending.
  • Restrict access to the studentlogin endpoint to authenticated users only if feasible, and audit logs for abnormal SQL activity to detect potential exploitation attempts.

Generated by OpenCVE AI on May 4, 2026 at 08:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Codeastro
Codeastro online Classroom
Vendors & Products Codeastro
Codeastro online Classroom
Type Values Removed Values Added
Description A vulnerability was detected in CodeAstro Online Classroom 1.0. Impacted is an unknown function of the file /OnlineClassroom/studentlogin. Performing a manipulation of the argument sid results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Title CodeAstro Online Classroom studentlogin sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 4, 2026, 12:46 PM
Reserved
May 3, 2026, 5:16 PM

View source JSON

Updated
May 4, 2026, 12:46 PM

JSON

Status
Deferred
Published
May 4, 2026, 8:16 AM
Modified
Oct 26, 2026, 7:10 PM

View source JSON

No data.

Updated
May 4, 2026, 9:00 AM

JSON