What is the CVSS score of CVE-2025-26198?

CVE-2025-26198 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of PHP are affected by CVE-2025-26198?

CloudClassroom-PHP-Project v1.0 contains a critical SQL injection vulnerability that allows unauthenticated attackers to bypass admin login controls and gain unauthorized administrative access to the…

Is there a public PoC exploit available for CVE-2025-26198?

Yes, a public proof-of-concept exploit is available for CVE-2025-26198. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-26198?

Within 24 hours: Disable or restrict network access to CloudClassroom-PHP-Project v1.0 until remediation is complete; audit admin account access logs for unauthorized login attempts. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns in the loginlinkadmin.php form inputs; implement input validation at the application level if source code access is available. Within 30 days: Migrate to a patched version once released; conduct a security assessment of the application environment and review all admin accounts for unauthorized access or modifications.

PHP CVE-2025-26198

EUVD-2025-18659 CRITICAL

SQL Injection (CWE-89)

2025-06-18 cve@mitre.org

PHP SQLi Authentication Bypass Information Disclosure Cloudclassroom Php Project

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 22:49 euvd

EUVD-2025-18659

Analysis Generated

Mar 14, 2026 - 22:49 vuln.today

PoC Detected

Jul 09, 2025 - 18:31 vuln.today

Public exploit code

CVE Published

Jun 18, 2025 - 18:15 nvd

CRITICAL 9.8

DescriptionCVE.org

CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data.

AnalysisAI

CloudClassroom-PHP-Project v1.0 contains a critical SQL injection vulnerability in the loginlinkadmin.php component that allows unauthenticated attackers to bypass authentication and gain unauthorized administrative access by injecting malicious SQL payloads into the username field. With a CVSS score of 9.8 and network-accessible attack vector requiring no privileges or user interaction, this vulnerability poses immediate and severe risk to all deployments. While specific KEV status and EPSS data were not provided in the intelligence sources, the combination of complete authentication bypass capability, high CVSS score, and trivial exploitation complexity suggests this is actively exploitable and likely to be targeted by opportunistic attackers.

Technical ContextAI

The vulnerability exists in CloudClassroom-PHP-Project v1.0, a PHP-based educational management application. The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a critical input validation flaw where user-supplied data from the admin login form's username parameter is directly concatenated into SQL queries without parameterized queries or input sanitization. The application likely constructs queries using string concatenation (e.g., "SELECT * FROM admins WHERE username='" . $_POST['username'] . "'") rather than prepared statements with bound parameters. The loginlinkadmin.php file serves as the entry point for administrative authentication, making it a high-value target. This is a classic presentation-layer vulnerability in PHP applications that predate modern security practices like PDO prepared statements or parameterized queries.

RemediationAI

Immediate Remediation Steps: (1) CRITICAL: Apply parameterized queries/prepared statements - replace all string concatenation in SQL queries with prepared statement bindings (e.g., PDO prepared statements with placeholders or MySQLi prepared statements). Rewrite loginlinkadmin.php to use: $stmt = $pdo->prepare('SELECT * FROM admins WHERE username = ?'); $stmt->execute([$_POST['username']]); (2) Input Validation: Implement strict input validation on the username field - whitelist allowed characters, enforce length limits, and reject special SQL metacharacters if parameterized queries cannot be immediately deployed. (3) Patch: Check CloudClassroom project repository (likely GitHub) for v1.1 or later releases. If the project is abandoned, consider forking and patching or migrating to maintained alternatives. (4) Temporary Mitigation (if patching is delayed): Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the username parameter; restrict access to loginlinkadmin.php to known IP ranges if possible. (5) Post-Remediation: Audit all other PHP input points for similar SQL injection vulnerabilities; migrate entire application to ORM or query builder frameworks (e.g., Doctrine, Eloquent). No official vendor patch link was provided in the intelligence sources; contact project maintainers or check GitHub repository directly.