CVE-2026-7743 — CodeAstro Online Classroom SQL Injection

title: CVE-2026-7743 - CodeAstro Online Classroom SQL Injection via deleteid
id: scw-2026-05-04-ai-1
status: experimental
level: high
description: |
  Detects SQL injection attempts targeting the CodeAstro Online Classroom application by looking for specific patterns in the URI query string related to the 'deleteid' parameter, including common SQL injection syntax like ' OR ' and ' = ' with a tautology like '1=1'. This targets the vulnerability described in CVE-2026-7743.
author: SCW Feed Engine (AI-generated)
date: 2026-05-04
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7743/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/OnlineClassroom/studentdetails'
      cs-uri-query|contains:
          - 'deleteid='
      cs-uri-query|contains:
          - ' OR '
      cs-uri-query|contains:
          - ' = '
      cs-uri-query|contains:
          - '1=1'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse