CloudClassroom-PHP CVE-2025-44608

No special conditions required beyond network access to the application - CVSS AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default installations of CloudClassroom-PHP Project v1.0. The viewid parameter must be processed by the vulnerable code path, which is part of the application's standard functionality and requires no specific non-default configuration. Exploitation is limited to version 1.0 specifically (per CPE data); other versions are not confirmed affected. The primary limiting factors are: the application must be network-accessible (self-hosted instances behind a firewall or VPN are not reachable remotely), and impact is bounded to partial data confidentiality and integrity (C:L/I:L) - full database takeover or RCE is not indicated by available data.

The CVSS 6.5 base score reflects the ease of exploitation (AV:N/AC:L/PR:N/UI:N) tempered by limited impact scope (C:L/I:L/A:N, S:U). This is a real, exploitable vulnerability - not an inflated theoretical one. However, several signals constrain actual risk: EPSS at 0.31% (23rd percentile) indicates that, despite public POC availability, mass exploitation has not materialized at time of analysis; this is consistent with the niche deployment footprint of a student/hobbyist PHP project. The absence of a CISA KEV listing further supports this assessment. The public GitHub POC does meaningfully lower the barrier for exploitation by low-skilled attackers, so any publicly accessible instance should be treated as at risk. Impact is bounded at partial data read and write (C:L/I:L), meaning full database compromise or remote code execution is not indicated by the available data - though secondary chained attacks (credential harvesting from database, account takeover) remain plausible. No conflicting CVSS signals identified.

An unauthenticated remote attacker identifies a publicly accessible CloudClassroom-PHP v1.0 instance and sends a crafted HTTP GET or POST request containing a SQL injection payload in the viewid parameter (e.g., viewid=1 UNION SELECT username,password,null FROM users--). The application passes this value unsanitized into a SQL query, returning sensitive data from the database - such as user credentials or course records - in the HTTP response. A public POC on GitHub at https://github.com/mr-xmen786/CVE-2025-44608 demonstrates this technique.