CodeAstro Online Job Portal CVE-2026-7028

Exploitation requires valid admin-level credentials (PR:H - high privileges). The attacker must have authenticated access to the CodeAstro admin panel. No special product configuration, feature toggle, or non-default deployment mode is mentioned in the CVE description; however, the admin panel itself must be network-accessible (typical for web applications but may be restricted via IP-based ACLs in hardened deployments). The vulnerability is limited to authenticated admin users; unauthenticated remote exploitation is not possible. Admin account compromise, insider threats, or weak/default admin credentials are realistic prerequisites for real-world attacks.

The CVSS score of 4.7 (Medium) reflects a network-accessible vulnerability with low attack complexity but significant authentication requirements (PR:H - admin privileges only). The attack vector is network-based (AV:N) with unchanged scope (S:U), allowing compromised or malicious admins to exfiltrate or corrupt data (C:L, I:L, A:L impact ratings). The presence of public exploit code (E:P in CVSS vector) and confirmed availability increase practical exploitation risk, but the admin-level privilege requirement substantially limits the attack surface. The EPSS score is not provided, but the combination of low complexity, public POC, and authenticated-only access suggests this is a real but somewhat constrained threat - primarily affecting organizations where admin account compromise or insider threats are concerns. The low-to-moderate CVSS rating appropriately reflects that this is not an unauthenticated remote code execution scenario, yet the SQL injection capability and public tooling warrant timely patching.

An attacker with compromised or insider admin credentials logs into the CodeAstro admin panel and navigates to the Jobs management page. The attacker intercepts or directly crafts an HTTP request to /admin/jobs-admins/delete-jobs.php with a malicious SQL payload in the ID parameter (e.g., ID=1' OR '1'='1). The server executes the attacker's injected SQL, allowing the attacker to delete all job records, exfiltrate job applicant data, or manipulate job postings. Public exploit code from GitHub automates this attack for threat actors.