Executive brief
CodeAstro Online Classroom is a web-based platform for managing educational content and student queries. A security vulnerability in the application's query submission feature allows an attacker to interfere with the underlying database. If exploited, this could lead to the unauthorized viewing of sensitive student or teacher information, data modification, or disruption of the classroom service.
Technical details
A SQL injection vulnerability exists in CodeAstro Online Classroom 1.0 within the /askquery.php file. The issue stems from insufficient validation and sanitization of the 'squeryx' POST parameter before it is used in a database query. A remote attacker with low-level privileges (such as a registered student) can provide malicious SQL payloads to perform error-based or time-based blind SQL injection. Successful exploitation allows the attacker to bypass authentication, access sensitive database records, or modify data. A public proof-of-concept (PoC) using sqlmap has been disclosed.
Affected products
- CodeAstro Online Classroom 1.0
Timeline
- 2026-04-20: disclosed: Initial disclosure on GitHub by user suze233
- 2026-05-07: advisory: CVE published and VulDB entry created