Technical impact
The flaw lies in the facultydetails module of CodeAstro Online Classroom 1.0, where the deleteid argument is incorporated into an SQL statement without proper sanitization, exemplifying CWE-74 and CWE-89 vulnerabilities. Attackers can supply malicious input to manipulate the query, allowing them to retrieve, alter, or delete database records. This class of issue can lead to data leakage and integrity compromise. Based on the description, it is inferred that the attacker could potentially access or modify data beyond the intended scope.
Affected Systems
The vulnerability affects CodeAstro’s Online Classroom product running version 1.0. No other versions are documented, and the exact module or function that processes deleteid is not identified beyond the facultydetails file path.
Risk and Exploitability
The CVSS score is 5.3, indicating a moderate risk level. No EPSS score is provided, so precise exploitation likelihood cannot be quantified, but the flaw is publicly disclosed and can be triggered remotely through crafted requests, indicating it could be abused if the target is exposed to the web. The issue is not listed in CISA's KEV catalog, so there is no current evidence of widespread exploitation. Users of v1.0 should evaluate the exposure and pursue mitigations promptly.
