This vulnerability affects CodeAstro Online Classroom 1.0 and 2.php in the /OnlineClassroom/takeassessment2.php script via the Q1 parameter. Manipulating this parameter leads to SQL injection, enabling remote attackers to potentially execute arbitrary SQL queries on the backend database. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. No official fix or patch is currently documented, and the product is not a cloud service, so remediation depends on vendor updates or user-applied mitigations.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the affected system's database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per the CVSS 4.0 vector. There are no confirmed active exploitations in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor for vendor updates and consider applying input validation or parameterized queries as temporary mitigations if possible. Avoid exposing the vulnerable endpoint to untrusted networks until a fix is available.