CVE-2026-5579
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In CodeAstro Online Classroom 1.0, a SQL injection vulnerability was found in the file /OnlineClassroom/updatedetailsfromfaculty.php?myfid=108 via manipulation of the fname argument. The attack can be performed remotely and the exploit has been publicly disclosed.
Risk Assessment
An attacker can execute arbitrary SQL queries, potentially leading to data leakage or application takeover.
Recommendation
Immediately implement parameterized SQL queries or prepared statements in updatedetailsfromfaculty.php and restrict access to this file.
Original NVD description (English source)
A vulnerability was determined in CodeAstro Online Classroom 1.0. This issue affects some unknown processing of the file /OnlineClassroom/updatedetailsfromfaculty.php?myfid=108 of the component Parameter Handler. Executing a manipulation of the argument fname can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.