CVE-2026-5580

Vulnerability

Overview A SQL injection vulnerability exists in CodeAstro Online Classroom version 1.0, specifically in the /OnlineClassroom/addvideos.php file. The root cause is insufficient validation of the videotitle parameter, which is directly concatenated into SQL queries without proper sanitization or parameterization. This flaw enables attackers to inject malicious SQL payloads through the parameter, leading to unauthorized database operations [1].

Exploitation

An attacker can exploit this vulnerability remotely by sending a crafted POST request to the vulnerable script with a malicious videotitle value. No authentication appears to be required. A proof-of-concept payload for time-based blind SQL injection has been publicly disclosed, demonstrating reliable exploitation. The attack surface is accessible over the network, making it easy for remote adversaries to target the application [1].

Impact

Successful exploitation allows attackers to gain unauthorized access to the underlying database. Potential consequences include reading sensitive data (such as user credentials or personal information), modifying or deleting records, and in some cases achieving complete system compromise. The public availability of exploit code increases the risk of active attacks against unpatched installations [1].

Mitigation

The vendor (CodeAstro) has not released a fix for this vulnerability as of the publication date. Users are advised to implement input validation and use prepared statements with parameterized queries to prevent SQL injection. Until a patch is available, network-level controls such as web application firewalls may help mitigate exploitation. The software is available from CodeAstro's website [2].