Is there a public PoC exploit available for CVE-2026-8097?

Yes, a public proof-of-concept exploit is available for CVE-2026-8097. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro Online Classroom CVE-2026-8097

Q: What is the CVSS score of CVE-2026-8097?

CVE-2026-8097 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28443 LOW

SQL Injection (CWE-89)

2026-05-07 VulDB

GHSA-34v6-h57v-gx5f

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 07, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

May 07, 2026 - 21:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 07, 2026 - 21:16 vuln.today

CVE Published

May 07, 2026 - 20:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A security flaw has been discovered in CodeAstro Online Classroom 1.0. This vulnerability affects unknown code of the file /askquery.php. The manipulation of the argument squeryx results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in CodeAstro Online Classroom 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the squeryx parameter in /askquery.php, enabling unauthorized data access, modification, and potential denial of service. Publicly available exploit code exists and the vulnerability affects the default installation with no special configuration required.

Technical ContextAI

The vulnerability exists in the PHP-based Online Classroom application at the /askquery.php endpoint. The squeryx parameter is passed directly to SQL queries without proper input sanitization or parameterized statement preparation, resulting in classic SQL injection (CWE-89). The affected CPE cpe:2.3:a:codeastro:online_classroom:*:*:*:*:*:*:*:* indicates all versions of CodeAstro Online Classroom are potentially vulnerable. The attack vector is network-based, requiring only basic HTTP requests to craft malicious SQL payloads through the vulnerable parameter.

RemediationAI

Update CodeAstro Online Classroom to a patched version released by the vendor. Exact patched version numbers are not confirmed in available data; contact CodeAstro directly via https://codeastro.com/ or check their security advisories for the current patch. As an interim compensating control, restrict network access to /askquery.php using web application firewall rules or reverse proxy restrictions, allowing only trusted internal networks if the classroom is accessed by a limited user base. Implement input validation and prepared statements (parameterized queries) for the squeryx parameter at the application code level if source code access is available. Monitor database logs for suspicious SQL syntax patterns such as UNION, OR 1=1, DROP, or time-based delay payloads. Note that these controls do not remediate the underlying vulnerability and should be considered temporary until patching is completed.