# CVE-2026-5579: CodeAstro Online Classroom SQL injection in updatedetailsfromfaculty.php

Source: https://junglewise.ai/threats/cve-2026-5579-codeastro-online-classroom-sql-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-05. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5579 · Severity: medium · CVSS 6.3 · Published 2026-04-05

CodeAstro Online Classroom is a web-based platform for managing educational content and student-faculty interactions. A security vulnerability in the faculty profile update component allows an attacker to interfere with the application's database. If exploited, this could lead to unauthorized access to sensitive information, data tampering, or disruption of the classroom service.

Technologies: [CodeAstro Online Classroom](https://junglewise.ai/threats/technologies/online-classroom). Vendors: [CodeAstro](https://junglewise.ai/threats/vendors/codeastro).

## Quick answers

**Is CVE-2026-5579 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5579 being exploited in the wild.

**How severe is CVE-2026-5579?** Medium severity, with a CVSS score of 6.3, published 5 April 2026.

**Which products and versions are affected?** CodeAstro Online Classroom 1.0.

**Is there a fix for CVE-2026-5579?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5579 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-5579?** Check whether you run CodeAstro Online Classroom at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in CodeAstro Online Classroom 1.0 within the 'updatedetailsfromfaculty.php' file. The root cause is the improper neutralization of the 'fname' POST parameter before it is used in a database query. A remote attacker with low-level privileges (such as a faculty account) can submit crafted SQL commands to perform boolean-based blind, error-based, or time-based blind injection. This allows for unauthorized database enumeration, data extraction, and potential modification of records. The exploit has been publicly disclosed via a GitHub issue including a proof-of-concept using sqlmap.

## Affected products

- CodeAstro Online Classroom 1.0

## Timeline

- 2026-03-20: disclosed: Vulnerability details and PoC published on GitHub.
- 2026-04-05: advisory: CVE-2026-5579 published.

## References

- [https://codeastro.com/](https://codeastro.com/)
- [https://github.com/zgr0508/cve/issues/2](https://github.com/zgr0508/cve/issues/2)
- [https://vuldb.com/submit/783752](https://vuldb.com/submit/783752)
- [https://vuldb.com/vuln/355349](https://vuldb.com/vuln/355349)
- [https://vuldb.com/vuln/355349/cti](https://vuldb.com/vuln/355349/cti)

## Related threats

- [CodeAstro Online Classroom SQL injection in loginlinkadmin.php](https://junglewise.ai/threats/cve-2026-16765-codeastro-online-classroom-sql-injection-in-loginlinkadmin-php)
- [CodeAstro Online Classroom SQL injection in askquery.php](https://junglewise.ai/threats/cve-2026-8097-codeastro-online-classroom-sql-injection-in-askquery-php)
- [CodeAstro Online Classroom SQL injection in guestdetails](https://junglewise.ai/threats/cve-2026-7196-codeastro-online-classroom-sql-injection-in-guestdetails)
- [CodeAstro Online Classroom SQL injection in addvideos.php](https://junglewise.ai/threats/cve-2026-5580-codeastro-online-classroom-sql-injection-in-addvideos-php)
- [CodeAstro Online Classroom SQL injection in deleteid parameter](https://junglewise.ai/threats/cve-2026-5578-codeastro-online-classroom-sql-injection-in-deleteid-parameter)