CVE-2026-6033

BRIEFING NOTE: CVE-2026-6033 CodeAstro Online Classroom version 1.0 contains a SQL injection vulnerability in the /updatedetailsfromstudent.php file, specifically within the fname parameter. The flaw allows unauthenticated attackers to execute arbitrary SQL commands by manipulating user input during account detail updates, potentially compromising sensitive student and institutional data stored in the application's database. The vulnerability carries a CVSS 3.1 base score of 6.3 (Medium severity) and can be exploited remotely by authenticated users with relatively low attack complexity. The attack requires valid user credentials but does not demand user interaction, and successful exploitation could result in unauthorized data disclosure, modification, or deletion with moderate impact across confidentiality, integrity, and availability. Public exploit code for this vulnerability has been disclosed, indicating awareness within the security community. However, the CVE is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. The relatively low EPSS score of 0.00031 suggests minimal current exploitation probability, though the availability of public proof-of-concept code presents risk to unpatched deployments. RECOMMENDATION: Organizations using CodeAstro Online Classroom 1.0 should prioritize patching or upgrading to a remediated version and implement input validation controls to mitigate SQL injection risks.