CVE-2026-7742

CodeAstro Online Classroom facultylogin sql injection

View on CVE.org
Published May 4, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in CodeAstro Online Classroom 1.0. The affected element is an unknown function of the file /OnlineClassroom/facultylogin. Executing a manipulation of the argument fid can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

Analysis

AI-generated

Technical impact

An unknown function within the /OnlineClassroom/facultylogin file of CodeAstro Online Classroom 1.0 allows manipulation of the fid argument, leading to SQL injection (CWE-74 and CWE-89). An attacker who supplies a crafted fid value can inject arbitrary SQL statements, potentially reading, modifying, or deleting sensitive data stored in the application database. The flaw presents a direct path to compromise data confidentiality, integrity, and availability without needing local access.

Affected Systems

The vulnerability affects CodeAstro Online Classroom version 1.0. No other product versions are listed as impacted.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate severity, and no EPSS information is available, suggesting low-to-moderate exploitation likelihood at this time. The vulnerability is not listed in the CISA KEV catalog, but the fact that a published exploit exists means it could be employed by adversaries. As the attack vector is remote through the facultylogin interface, any publicly accessible instance is a potential target.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest CodeAstro Online Classroom patch that addresses the SQL injection flaw
  • If no patch is available, modify the facultylogin handler to use parameterized queries and validate the fid parameter before including it in SQL statements
  • Restrict access to the facultylogin endpoint by IP whitelisting or network segmentation, and monitor logs for suspicious query patterns

Generated by OpenCVE AI on May 4, 2026 at 08:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Codeastro
Codeastro online Classroom
Vendors & Products Codeastro
Codeastro online Classroom
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in CodeAstro Online Classroom 1.0. The affected element is an unknown function of the file /OnlineClassroom/facultylogin. Executing a manipulation of the argument fid can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
Title CodeAstro Online Classroom facultylogin sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 4, 2026, 10:33 AM
Reserved
May 3, 2026, 5:16 PM

View source JSON

Updated
May 4, 2026, 10:33 AM

JSON

Status
Deferred
Published
May 4, 2026, 8:16 AM
Modified
Oct 26, 2026, 7:10 PM

View source JSON

No data.

Updated
May 4, 2026, 11:30 AM

JSON