A flaw was discovered in CodeAstro Online Classroom 1.0 where manipulating the fname argument in the /OnlineClassroom/addnewstudent endpoint can trigger an SQL injection vulnerability. The injection allows an attacker to execute arbitrary SQL commands against the application’s database. This can lead to unauthorized data disclosure, modification, or deletion of student records and undermine application integrity.

The affected product is CodeAstro Online Classroom version 1.0. The vulnerability resides in the addnewstudent functionality located at /OnlineClassroom/addnewstudent; the specific function within the file is not documented in the advisory.

The CVSS score of 5.3 indicates moderate severity. An attacker can exploit the flaw remotely and the exploit has been made public, suggesting that remote users could attempt exploitation without privileged access. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying that large‑scale exploitation has not yet been observed. Nonetheless, the public nature of the exploit and remote attack surface warrant timely attention.