This vulnerability in CodeAstro Online Classroom 1.0 involves an SQL injection flaw in the Parameter Handler component, specifically in the /OnlineClassroom/addassessment.php file. By manipulating the 'deleteid' argument, an attacker can inject SQL commands remotely. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official vendor patch or fix has been published as of the data provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated as medium with limited confidentiality, integrity, and availability impact. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall (WAF) rules to detect and block malicious SQL injection attempts targeting the 'deleteid' parameter. Monitoring for unusual database activity related to this parameter is also advisable.