CVE-2026-7745: Online Classroom 1.0 SQLi Vulnerability

CVE-2026-7745 Overview

CVE-2026-7745 is a SQL injection vulnerability in CodeAstro Online Classroom 1.0. The flaw resides in the /OnlineClassroom/facultydetails endpoint, where the deleteid parameter is incorporated into a database query without proper sanitization. Remote attackers with low privileges can manipulate the parameter to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic attacks. The weakness maps to [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Authenticated remote attackers can manipulate the deleteid parameter to execute arbitrary SQL queries against the application database, potentially exposing or modifying faculty and classroom data.

Affected Products

• CodeAstro Online Classroom 1.0
• Endpoint: /OnlineClassroom/facultydetails
• Parameter: deleteid

Discovery Timeline

• 2026-05-04 - CVE-2026-7745 published to NVD
• 2026-05-04 - Last updated in NVD database

Technical Details for CVE-2026-7745

Vulnerability Analysis

The vulnerability exists in the faculty details handler of CodeAstro Online Classroom 1.0. The application accepts the deleteid argument from a remote request and concatenates it into a SQL statement without parameterization or input validation. An attacker submits crafted input that breaks out of the intended query context and appends additional SQL clauses. The injected statements execute with the privileges of the application's database account.

Because the endpoint is reachable over the network and only requires low-level authentication, an attacker who registers or compromises any low-privileged account can reach the vulnerable code path. Public disclosure of the issue lowers the technical barrier for exploitation, since proof-of-concept details are referenced in the GitHub Issue Discussion and VulDB Vulnerability #360920.

Root Cause

The root cause is improper neutralization of user-supplied input passed to a downstream SQL interpreter [CWE-74]. The deleteid parameter is interpolated directly into a query string used to delete or look up faculty records. The application does not use prepared statements, parameter binding, or strict type validation on the identifier.

Attack Vector

An attacker sends an HTTP request to /OnlineClassroom/facultydetails with a manipulated deleteid value. By appending SQL operators, UNION clauses, or boolean conditions to the parameter, the attacker can read arbitrary tables, modify rows, or delete data. The attack is performed remotely and does not require user interaction. Because the EPSS dataset records a low probability of exploitation in the wild, the most likely scenarios are targeted abuse of exposed deployments rather than mass exploitation.

No verified exploitation code is published in the referenced advisories. See the VulDB CTI #360920 record for additional technical context.

Detection Methods for CVE-2026-7745

Indicators of Compromise

• HTTP requests to /OnlineClassroom/facultydetails containing SQL metacharacters such as ', --, UNION, or SLEEP( in the deleteid parameter.
• Database error messages or unexpected query latency originating from the faculty details endpoint.
• Anomalous DELETE or SELECT operations against faculty-related tables outside normal administrator activity.

Detection Strategies

• Inspect web server and application logs for non-numeric values in the deleteid query parameter.
• Deploy a web application firewall ruleset that flags SQL injection signatures targeting /OnlineClassroom/* paths.
• Correlate authentication logs with database query logs to identify low-privileged accounts issuing administrative-style queries.

Monitoring Recommendations

• Enable verbose query logging on the backend database to capture statements generated from the faculty details handler.
• Alert on repeated 500-series HTTP responses from the affected endpoint, which often accompany injection probing.
• Monitor for outbound connections from the database host that could indicate post-exploitation data exfiltration.

How to Mitigate CVE-2026-7745

Immediate Actions Required

• Restrict access to /OnlineClassroom/facultydetails to trusted networks until a fix is applied.
• Audit existing faculty and classroom records for unauthorized modifications or deletions.
• Rotate database credentials used by the Online Classroom application.
• Review accounts with low-privilege access and disable any that are unused or unrecognized.

Patch Information

No vendor patch is referenced in the available CVE data. Operators should monitor the CodeAstro Security Resource for updates and apply any released fix promptly. Until a patch is available, refactor the affected handler to use parameterized queries with strict integer validation on deleteid.

Workarounds

• Implement a web application firewall rule that rejects requests where deleteid is not a positive integer.
• Modify the application code to cast deleteid to an integer before query construction and use prepared statements.
• Apply least-privilege principles to the database account so it cannot perform schema changes or read unrelated tables.
• Disable or remove the faculty details deletion feature if it is not required for production operations.

# Example WAF rule (ModSecurity) restricting deleteid to integers
SecRule REQUEST_URI "@beginsWith /OnlineClassroom/facultydetails" \
    "chain,id:1027745,phase:2,deny,status:400,msg:'CVE-2026-7745 SQLi guard'"
  SecRule ARGS:deleteid "!@rx ^[0-9]+$" "t:none"