Online Classroom CVE-2026-6010

This vulnerability presents moderate-to-significant real-world risk despite the 6.3 CVSS score. The CVSS vector indicates network-accessible attack surface (AV:N), low attack complexity (AC:L), and requires low privilege authentication (PR:L), meaning any authenticated user (student, instructor, or legitimate platform user) can exploit it without special access. The E:P field confirms publicly available exploit code exists, substantially lowering the bar for exploitation. EPSS probability is not provided, but the confluence of low attack complexity, public POC availability, and the widespread use of SQL injection attacks in education sector targeting systems suggests real exploitation likelihood. The three-vector impact (C:L/I:L/A:L) indicates confidentiality, integrity, and availability compromise-attackers can read sensitive data, modify grades or assessment records, and potentially cause denial of service. The RC:R (Reasonable confidence) supports these claims. This is not merely theoretical: any institution running CodeAstro Online Classroom with internet-facing deployment and user authentication enabled is vulnerable to data theft of student records, grade manipulation, or lateral movement within the database.

An authenticated student or instructor logs into a CodeAstro Online Classroom instance and navigates to an assessment page (takeassessment2.php?exid=14). The attacker crafts a malicious SQL payload in the Q1 parameter, such as Q1=1' UNION SELECT username, password FROM users WHERE '1'='1, and submits it. The vulnerable PHP code directly concatenates this input into a SQL query without escaping, causing the database to execute the injected UNION query. The attacker exfiltrates the user credentials table, then uses those credentials to access other assessments, modify grades, or escalate privileges. Publicly available POC code from GitHub (https://github.com/xue-p123/vuldb-research/issues/2) lowers the barrier to entry, making this practical for opportunistic attackers or competitors seeking to manipulate academic records.