CodeAstro Online Classroom CVE-2026-8097

Authentication is REQUIRED - the CVSS vector PR:L confirms that exploitation necessitates valid user credentials for the CodeAstro Online Classroom application. The vulnerable /askquery.php endpoint must be accessible over the network (default deployment). No other special configuration, feature flags, or non-default settings are mentioned in available data, indicating the vulnerability is present in standard installations. An attacker must be able to submit HTTP requests to the web application and possess or obtain valid login credentials to access the vulnerable endpoint.

CVSS 6.3 with AV:N/AC:L/PR:L indicates network-accessible SQL injection requiring only low-privilege authentication. The CVSS vector shows E:P (exploit proof-of-concept exists) and RC:R (reasonable confidence), aligned with the public availability of working exploit code. However, the PR:L requirement (authenticated access needed) significantly constrains real-world risk compared to unauthenticated SQL injection vulnerabilities - attackers must first obtain valid user credentials. The low CVSS impact scores (C:L/I:L/A:L) suggest confidentiality, integrity, and availability are only partially compromised per query, though cumulative exploitation could escalate. The reasonable confidence rating and public POC availability elevate tactical risk for organizations running unpatched instances. No KEV status provided, but public exploit availability indicates mature threat knowledge. Organizations using Online Classroom should prioritize patching, but the authentication barrier reduces likelihood of opportunistic exploitation compared to unauthenticated SQL injection.

An authenticated user with valid credentials logs into CodeAstro Online Classroom and crafts a malicious HTTP request to /askquery.php with a SQL injection payload embedded in the squeryx parameter (e.g., squeryx=test' OR '1'='1). The unvalidated parameter is concatenated directly into an SQL query, allowing the attacker to extract sensitive data such as user credentials, course content, or grades, or modify database records. Public exploit code on GitHub demonstrates the exact payload syntax, lowering the technical barrier for attackers.