This vulnerability involves an SQL injection in CodeAstro Online Classroom 1.0, specifically in the /OnlineClassroom/addnewstudent endpoint. The injection occurs via the 'fname' argument, enabling an attacker to manipulate SQL queries executed by the application. The vulnerability is remotely exploitable without authentication or user interaction, with a CVSS 4.0 base score of 5.3 indicating medium severity. No vendor advisory or patch information is currently available, and no known active exploitation has been reported.

Successful exploitation could allow an attacker to manipulate backend SQL queries, potentially leading to unauthorized data access or modification within the affected application database. The medium CVSS score reflects limited impact or complexity factors, but the exact consequences depend on the database and application context. No confirmed active exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing input validation or web application firewall rules to detect and block SQL injection attempts targeting the 'fname' parameter in the /OnlineClassroom/addnewstudent endpoint.