This vulnerability involves SQL injection via the fname argument in the /OnlineClassroom/addnewstudent endpoint of CodeAstro Online Classroom 1.0. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the backend database. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No official fix or mitigation has been published by the vendor, and the product is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated low to medium on confidentiality, integrity, and availability, consistent with the CVSS vector. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or parameterized queries on the fname parameter as a temporary mitigation. Monitor vendor channels for updates and apply patches promptly once released.