Online Classroom CVE-2026-6033

While the CVSS score of 5.3 indicates moderate severity, the real-world risk is contextually bounded by three factors. First, the CVSS vector explicitly requires PR:L (low privilege authentication), meaning an attacker must be a registered user of the platform-not an unauthenticated threat actor. Second, the impact scope is limited to low-level confidentiality and integrity violations (VC:L, VI:L, VA:L) with no scope expansion, suggesting data exfiltration is possible but broad system compromise is unlikely. Third, the EPSS value is not provided, but the presence of publicly available exploit code and a teaching/learning platform context (typically internal or institutional deployments) suggests moderate real-world exploitation likelihood within organizational boundaries. SSVC analysis: exploitation is public (E:P per CVSS), the attack is automatable via SQL injection, and technical impact is moderate. This is a legitimate remediation priority for administrators managing CodeAstro deployments, but not a critical emergency threatening widespread public exposure. Organizations using CodeAstro should prioritize patching after internal users are considered.

An authenticated student or instructor user with access to CodeAstro Online Classroom crafts an HTTP request to /updatedetailsfromstudent.php?eno=146891650 with a malicious SQL payload embedded in the fname parameter, such as fname='; DROP TABLE students;-- or fname=' OR '1'='1. Because the endpoint fails to sanitize this input, the injected SQL is executed by the database, allowing the attacker to read sensitive student records, modify grades or enrollment data, or in severe cases, delete database tables. Publicly available exploit code documented in GitHub (https://github.com/yuji0903/silver-guide/issues/17) lowers the technical barrier for exploitation, making this a practical risk for organizations running vulnerable CodeAstro instances.