This vulnerability allows an attacker to inject malicious SQL code via the squeryx argument in the /askquery.php file of CodeAstro Online Classroom 1.0. The injection occurs due to insufficient input validation or sanitization, enabling remote attackers to potentially manipulate backend database queries. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official fix or patch has been published, and the product is not a cloud service, so remediation depends on vendor updates or user-applied mitigations.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited scope and no evidence of active exploitation. The vulnerability affects only version 1.0 of the CodeAstro Online Classroom product.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or web application firewall rules to detect and block suspicious SQL injection attempts targeting the squeryx parameter. Monitoring for unusual database activity related to this endpoint is also advisable.