Executive brief
CodeAstro Online Classroom is a web-based platform for managing educational content and student records. A security flaw in the student profile update feature allows an attacker to interfere with the application's database. This could lead to the unauthorized viewing of sensitive student information, modification of records, or disruption of the classroom service.
Technical details
A SQL injection vulnerability exists in CodeAstro Online Classroom 1.0 within the 'updatedetailsfromstudent.php' component. The root cause is the improper neutralization of special elements in the 'fname' POST parameter, which is used directly in SQL queries without sufficient validation or prepared statements. A remote attacker with low privileges (authenticated as a student) can exploit this by sending crafted SQL payloads to perform boolean-based blind, error-based, or time-based blind injection. Successful exploitation allows for unauthorized database access, data leakage, and potential tampering with system records. As of the advisory date, no official patch has been released, and users are advised to implement prepared statements and input filtering manually.
Affected products
- CodeAstro Online Classroom 1.0
Timeline
- 2026-04-02: disclosed: Vulnerability details and PoC published on GitHub
- 2026-04-10: advisory: CVE-2026-6033 published