Executive brief
CodeAstro Online Classroom is a web-based platform for managing educational content and student interactions. A security flaw in the administrative login component allows remote attackers to interfere with the application's database. This could lead to unauthorized access to sensitive student or teacher data, modification of records, or disruption of the classroom service.
Technical details
A SQL injection vulnerability exists in CodeAstro Online Classroom 1.0 within the '/OnlineClassroom/loginlinkadmin.php' component. The root cause is the failure to properly sanitize or validate the 'aid' POST parameter before using it in a database query. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request containing malicious SQL commands. Successful exploitation, demonstrated via time-based blind SQL injection techniques, allows for unauthorized database access, data exfiltration, and potential full system compromise. As of the advisory date, no official patch has been confirmed, though using prepared statements is the recommended remediation.
Affected products
- CodeAstro Online Classroom 1.0
Timeline
- 2026-06-17: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-07-23: advisory: NVD/VulDB publication date