This vulnerability exists in CodeAstro Online Classroom 1.0 within the Parameter Handler component, specifically in the /OnlineClassroom/addassessment.php file. Manipulating the 'deleteid' parameter can lead to SQL injection, enabling attackers to execute unauthorized SQL commands remotely. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts. There is no vendor advisory or patch available at this time.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated as limited in confidentiality, integrity, and availability, indicating that the scope of damage is constrained. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and parameterized queries on the affected parameter 'deleteid' to mitigate SQL injection risks. Monitor for updates from CodeAstro regarding patches or official mitigations.