# CVE-2026-8097: CodeAstro Online Classroom SQL injection in askquery.php

Source: https://junglewise.ai/threats/cve-2026-8097-codeastro-online-classroom-sql-injection-in-askquery-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-8097 · Severity: medium · CVSS 6.3 · Published 2026-05-07

CodeAstro Online Classroom is a web-based platform for managing educational content and student queries. A security vulnerability in the application's query submission feature allows an attacker to interfere with the underlying database. If exploited, this could lead to the unauthorized viewing of sensitive student or teacher information, data modification, or disruption of the classroom service.

Technologies: [CodeAstro Online Classroom](https://junglewise.ai/threats/technologies/online-classroom). Vendors: [CodeAstro](https://junglewise.ai/threats/vendors/codeastro).

## Quick answers

**Is CVE-2026-8097 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8097 being exploited in the wild.

**How severe is CVE-2026-8097?** Medium severity, with a CVSS score of 6.3, published 7 May 2026.

**Which products and versions are affected?** CodeAstro Online Classroom 1.0.

**Is there a fix for CVE-2026-8097?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8097 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8097?** Check whether you run CodeAstro Online Classroom at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in CodeAstro Online Classroom 1.0 within the /askquery.php file. The issue stems from insufficient validation and sanitization of the 'squeryx' POST parameter before it is used in a database query. A remote attacker with low-level privileges (such as a registered student) can provide malicious SQL payloads to perform error-based or time-based blind SQL injection. Successful exploitation allows the attacker to bypass authentication, access sensitive database records, or modify data. A public proof-of-concept (PoC) using sqlmap has been disclosed.

## Affected products

- CodeAstro Online Classroom 1.0

## Timeline

- 2026-04-20: disclosed: Initial disclosure on GitHub by user suze233
- 2026-05-07: advisory: CVE published and VulDB entry created

## References

- [http://github.com/suze233/CVE/issues/1](http://github.com/suze233/CVE/issues/1)
- [https://codeastro.com/](https://codeastro.com/)
- [https://vuldb.com/submit/808115](https://vuldb.com/submit/808115)
- [https://vuldb.com/vuln/361849](https://vuldb.com/vuln/361849)
- [https://vuldb.com/vuln/361849/cti](https://vuldb.com/vuln/361849/cti)

## Related threats

- [CodeAstro Online Classroom SQL injection in loginlinkadmin.php](https://junglewise.ai/threats/cve-2026-16765-codeastro-online-classroom-sql-injection-in-loginlinkadmin-php)
- [CodeAstro Online Classroom SQL injection in guestdetails](https://junglewise.ai/threats/cve-2026-7196-codeastro-online-classroom-sql-injection-in-guestdetails)
- [CodeAstro Online Classroom SQL injection in addvideos.php](https://junglewise.ai/threats/cve-2026-5580-codeastro-online-classroom-sql-injection-in-addvideos-php)
- [CodeAstro Online Classroom SQL injection in updatedetailsfromfaculty.php](https://junglewise.ai/threats/cve-2026-5579-codeastro-online-classroom-sql-injection-in)
- [CodeAstro Online Classroom SQL injection in deleteid parameter](https://junglewise.ai/threats/cve-2026-5578-codeastro-online-classroom-sql-injection-in-deleteid-parameter)