CVE-2026-5578

Vulnerability

Overview

A SQL injection vulnerability exists in CodeAstro Online Classroom version 1.0, specifically in the /OnlineClassroom/addassessment.php file. The root cause is insufficient validation of the deleteid parameter, which is directly incorporated into SQL queries without proper sanitization or parameterization [1]. This allows an attacker to inject malicious SQL code through the deleteid parameter.

Exploitation

The attack can be carried out remotely over HTTP GET requests. No authentication is required to reach the vulnerable endpoint. The attacker simply supplies a crafted deleteid value, such as a boolean-based blind or error-based payload, to manipulate the SQL query [1]. Proof-of-concept details have been publicly disclosed, increasing the risk of exploitation.

Impact

Successful exploitation enables an attacker to perform unauthorized database operations, including reading, modifying, or deleting sensitive data. In some cases, it may lead to full system compromise or denial of service [1]. The vulnerability poses a serious threat to data integrity and system availability.

Mitigation

As of the publication date, no official patch has been released by the vendor. Users are advised to implement input validation and use prepared statements or parameterized queries to mitigate the risk. Given the public availability of exploit code, immediate remediation is recommended.