CodeAstro Online Classroom EUVD-2026-26931

Authentication is required - the attacker must possess valid credentials for CodeAstro Online Classroom, typically a student, instructor, or administrative account. Access to the /OnlineClassroom/addnewstudent endpoint must be enabled (non-default or standard feature access). No special network configuration, proxy bypass, or client-side manipulation is required beyond standard HTTP requests. The vulnerability is exploitable from any network location with HTTP access to the application (remote exploitation). The low attack complexity (AC:L) confirms that no advanced techniques such as race conditions, timing attacks, or exploitation of unpredictable application state are necessary. The scope is unchanged (S:U), meaning exploitation does not elevate the attacker's privilege level or compromise other accounts directly - impact is limited to data accessible under the authenticated user's own or the application's database permissions.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P) indicates network-accessible exploitation with low attack complexity requiring authenticated privileges. The E:P rating confirms proof-of-concept availability. The PR:L (low privilege) requirement means a legitimate user account is needed, which somewhat limits exposure compared to unauthenticated SQL injection but is still exploitable within most educational institutions where student or staff accounts are commonplace. The moderate CVSS score of 6.3 accurately reflects the balanced risk profile: network exploitability and low complexity are offset by the authentication requirement. The public exploit availability increases real-world risk despite the authentication barrier, as insiders or compromised low-privilege accounts can execute attacks. However, the lack of high-impact consequences (Confidentiality/Integrity/Availability are all Low, not High) suggests the database is not running with elevated privileges or the application lacks access to highly sensitive data at the database level.

An authenticated user with a standard student or instructor account logs into CodeAstro Online Classroom and navigates to the student addition form or API endpoint. The attacker crafts a malicious request to /OnlineClassroom/addnewstudent with a crafted fname parameter value containing SQL metacharacters (e.g., fname=test' OR '1'='1' -- or UNION-based injection). The application concatenates this unsanitized input directly into a SQL query, which executes against the backend database. The attacker retrieves sensitive information such as other users' credentials, enrollment records, or grades, or modifies grades and enrollment data.