This vulnerability involves an SQL injection flaw in CodeAstro Online Classroom 1.0, specifically in the handling of the 'sid' parameter within the /OnlineClassroom/studentlogin endpoint. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the backend database. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and no user interaction needed. No official fix or patch has been documented, and the exploit is publicly known.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The exact impact depends on the database and application configuration, but the vulnerability poses a risk of data compromise. No evidence of active exploitation in the wild is currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the 'sid' parameter to mitigate SQL injection risks. Monitor vendor communications for updates on patches or official mitigations.