Executive brief
CodeAstro Online Classroom is a web-based platform for managing educational content and student interactions. A security flaw in the guest details management component allows an attacker to interfere with the application's database. This could lead to the unauthorized viewing of sensitive student information, modification of records, or disruption of the classroom service.
Technical details
A SQL injection vulnerability exists in CodeAstro Online Classroom 1.0 within the /guestdetails.php endpoint. The root cause is the improper neutralization of the 'deleteid' GET parameter before its use in a SQL query. A remote attacker with low privileges can exploit this by sending specially crafted SQL commands to perform error-based or time-based blind injection. Successful exploitation allows for unauthorized database access, data exfiltration, and potential tampering with records. A public exploit (PoC) has been disclosed.
Affected products
- CodeAstro Online Classroom 1.0
Timeline
- 2026-04-09: disclosed: Public issue opened on GitHub with PoC details
- 2026-04-27: advisory: VulDB entry created
- 2026-04-28: advisory: NVD published date