This vulnerability involves SQL injection via the deleteid argument in an unspecified function of the /OnlineClassroom/studentdetails endpoint in CodeAstro Online Classroom 1.0. An attacker can remotely exploit this flaw to inject malicious SQL commands, potentially compromising the backend database. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and no user interaction needed. No vendor advisory or patch information is provided, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The exact impact depends on the database privileges of the application and the nature of the injected queries. Since the vulnerability is remotely exploitable without authentication, it poses a moderate risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the deleteid parameter to prevent SQL injection. Monitoring and restricting access to the vulnerable endpoint may also reduce exposure.