CodeAstro Online Classroom 1.0 contains an SQL injection vulnerability in the /updatedetailsfromstudent.php script, specifically through the fname argument. This flaw allows an attacker to inject malicious SQL commands remotely without requiring user interaction or elevated privileges. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating moderate impact with low complexity and no required privileges. The vulnerability was publicly disclosed on April 10, 2026, but no official fix or patch has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the low privileges required and the limited scope indicated by the CVSS vector. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the fname parameter. Code review and input validation on the affected parameter are recommended as temporary mitigations.