Executive brief
CodeAstro Online Classroom is a web-based platform for managing educational content and student-faculty interactions. A security vulnerability in the faculty profile update component allows an attacker to interfere with the application's database. If exploited, this could lead to unauthorized access to sensitive information, data tampering, or disruption of the classroom service.
Technical details
A SQL injection vulnerability exists in CodeAstro Online Classroom 1.0 within the 'updatedetailsfromfaculty.php' file. The root cause is the improper neutralization of the 'fname' POST parameter before it is used in a database query. A remote attacker with low-level privileges (such as a faculty account) can submit crafted SQL commands to perform boolean-based blind, error-based, or time-based blind injection. This allows for unauthorized database enumeration, data extraction, and potential modification of records. The exploit has been publicly disclosed via a GitHub issue including a proof-of-concept using sqlmap.
Affected products
- CodeAstro Online Classroom 1.0
Timeline
- 2026-03-20: disclosed: Vulnerability details and PoC published on GitHub.
- 2026-04-05: advisory: CVE-2026-5579 published.