EUVD-2025-18659Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents CRITICAL real-world risk across multiple dimensions: (1) CVSS 9.8 reflects maximum exploitability - network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). (2) Attack complexity is trivial - classic SQL injection payloads like ' OR '1'='1 directly bypass login checks, requiring only basic SQL knowledge and HTTP client capability. (3) Impact scope is unrestricted (S:U), meaning the vulnerability can affect the entire system beyond the vulnerable component. (4) Exploitation appears highly probable and automatable - no complex preconditions exist, making this likely high on EPSS scores (estimated 85%+). (5) The vulnerability requires zero authentication and zero user interaction, eliminating typical friction points. (6) The described payload bypasses the login mechanism entirely, granting administrative privileges to unauthenticated attackers. This is not a theoretical high-CVSS-but-low-risk issue - it represents complete authentication bypass with direct administrative access. Priority is CRITICAL; immediate patching is required. |
| Exploit ScenarioDerived | Attack Scenario: An attacker, without prior authentication or credentials, navigates to the CloudClassroom admin login page (loginlinkadmin.php) and submits a POST request with username=' OR '1'='1-- or username=' OR '1'='1' (depending on PHP/MySQL version). The vulnerable code constructs a query like: SELECT * FROM admins WHERE username='' OR '1'='1'--'. The injected condition '1'='1' is always true, bypassing the password check and returning the first admin record (or all records depending on query structure). The attacker authenticates as an administrator without knowing any credentials. Once logged in, they gain full administrative access to CloudClassroom, including ability to modify user data, change grades, create backdoor accounts, or exfiltrate sensitive educational records. Attack complexity is extremely low - basic SQL syntax knowledge and a browser/curl suffice. No POC link was provided in the intelligence sources, but public databases (e.g., ExploitDB, GitHub) likely contain PoCs given the CVE publication. Exploitation can be completed in seconds by automated tools or manual injection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
CloudClassroom-PHP-Project v1.0 contains a critical SQL injection vulnerability in the loginlinkadmin.php component that allows unauthenticated attackers to bypass authentication and gain unauthorized administrative access by injecting malicious SQL payloads into the username field. With a CVSS score of 9.8 and network-accessible attack vector requiring no privileges or user interaction, this vulnerability poses immediate and severe risk to all deployments. While specific KEV status and EPSS data were not provided in the intelligence sources, the combination of complete authentication bypass capability, high CVSS score, and trivial exploitation complexity suggests this is actively exploitable and likely to be targeted by opportunistic attackers.
RemediationAI
Immediate Remediation Steps: (1) CRITICAL: Apply parameterized queries/prepared statements - replace all string concatenation in SQL queries with prepared statement bindings (e.g., PDO prepared statements with placeholders or MySQLi prepared statements). Rewrite loginlinkadmin.php to use: $stmt = $pdo->prepare('SELECT * FROM admins WHERE username = ?'); $stmt->execute([$_POST['username']]); (2) Input Validation: Implement strict input validation on the username field - whitelist allowed characters, enforce length limits, and reject special SQL metacharacters if parameterized queries cannot be immediately deployed. (3) Patch: Check CloudClassroom project repository (likely GitHub) for v1.1 or later releases. If the project is abandoned, consider forking and patching or migrating to maintained alternatives. (4) Temporary Mitigation (if patching is delayed): Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the username parameter; restrict access to loginlinkadmin.php to known IP ranges if possible. (5) Post-Remediation: Audit all other PHP input points for similar SQL injection vulnerabilities; migrate entire application to ORM or query builder frameworks (e.g., Doctrine, Eloquent). No official vendor patch link was provided in the intelligence sources; contact project maintainers or check GitHub repository directly.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in CloudClassroom-PHP-Project v1.0, a PHP-based educational management application. The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a critical input validation flaw where user-supplied data from the admin login form's username parameter is directly concatenated into SQL queries without parameterized queries or input sanitization. The application likely constructs queries using string concatenation (e.g., "SELECT * FROM admins WHERE username='" . $_POST['username'] . "'") rather than prepared statements with bound parameters. The loginlinkadmin.php file serves as the entry point for administrative authentication, making it a high-value target. This is a classic presentation-layer vulnerability in PHP applications that predate modern security practices like PDO prepared statements or parameterized queries.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data.
Executive ViewAI
CloudClassroom-PHP-Project v1.0 contains a critical SQL injection vulnerability that allows unauthenticated attackers to bypass admin login controls and gain unauthorized administrative access to the application. This poses an immediate risk to organizations using this software, as attackers can exploit this publicly disclosed vulnerability to compromise sensitive data, modify application configurations, and maintain persistent access.
Deploy WAF rules to block SQL injection payloads targeting loginlinkadmin.php; implement network segmentation to restrict access to the admin login interface to authorized IP ranges only; disable the admin login feature if not actively required; enforce rate limiting on login attempts; implement database activity monitoring to detect anomalous SQL queries; rotate all administrative credentials immediately and enforce multi-factor authentication on any alternative admin access methods.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB