This vulnerability involves an SQL injection in CodeAstro Online Classroom 1.0, specifically in an unknown function of the /OnlineClassroom/facultylogin file. By manipulating the 'fid' parameter, an attacker can inject SQL commands remotely, potentially compromising the backend database. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability is publicly known and exploit code is available, but no official patch or vendor remediation has been announced.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the CVSS vector indicates low impact on confidentiality, integrity, and availability, suggesting limited or partial impact. There are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider implementing web application firewalls or input validation controls to mitigate SQL injection risks on the affected parameter. Monitor for updates from CodeAstro regarding patches or official mitigations.