Executive brief
CodeAstro Online Classroom, a web-based educational platform, contains a security vulnerability that could allow an attacker to access or modify its underlying database. By sending specially crafted requests to the assessment management component, an attacker can bypass security controls to view sensitive student information or disrupt classroom operations. This issue stems from how the software handles specific database commands, potentially leading to unauthorized data access or loss of system integrity.
Technical details
A SQL injection vulnerability exists in CodeAstro Online Classroom 1.0 within the 'Parameter Handler' component. The issue is located in /OnlineClassroom/addassessment.php (and reportedly /OnlineClassroom/resultdetails.php) where the 'deleteid' GET parameter is used in a SQL query without sufficient sanitization or use of prepared statements. An authenticated attacker with network access can exploit this via boolean-based, error-based, or time-based blind injection techniques. Successful exploitation allows for unauthorized database access, data tampering, and potential leakage of sensitive information. A public proof-of-concept (PoC) using sqlmap has been disclosed.
Affected products
- CodeAstro Online Classroom 1.0
Timeline
- 2026-03-20: disclosed: Initial discovery and PoC shared on GitHub
- 2026-04-05: advisory: Vulnerability published by VulDB and NVD