An unknown function in the /OnlineClassroom/studentdetails endpoint accepts a deleteid argument that is not properly sanitized, allowing an attacker to inject arbitrary SQL statements. The vulnerability is a classic SQL injection flaw (CWE-74, CWE-89) and can be triggered remotely via HTTP requests. Abuse of this flaw can lead to unauthorized read or modification of database contents, potentially exposing sensitive student records and classroom data.

CodeAstro Online Classroom version 1.0 is known to be impacted.

The CVSS score of 5.3 indicates medium severity, and the exploit has already been disclosed publicly. While no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the remote attack vector and the presence of a public exploit suggest that the risk of exploitation in the wild is non‑negligible. Administrators should evaluate current exposure and consider how the flaw could affect confidentiality, integrity, and availability of the application data.