What is the CVSS score of CVE-2025-44608?

CVE-2025-44608 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2025-44608?

Yes, a public proof-of-concept exploit is available for CVE-2025-44608. Prioritise patching immediately. EPSS: 0.3%.

CloudClassroom-PHP CVE-2025-44608

MEDIUM

SQL Injection (CWE-89)

2025-07-25 cve@mitre.org

SQLi PHP Cloudclassroom Php Project

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated SQLi with no interaction required; partial read and write impact only, no availability effect and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:49 vuln.today

DescriptionCVE.org

CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter.

AnalysisAI

SQL injection in CloudClassroom-PHP Project v1.0 exposes the application to remote, unauthenticated database manipulation via the viewid parameter. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero prerequisites - any internet-accessible instance is directly exploitable without credentials. A publicly available proof-of-concept exists on GitHub, though EPSS at 0.31% (23rd percentile) indicates low observed exploitation probability at time of analysis, consistent with the obscure deployment footprint of this niche educational PHP application. No active exploitation is confirmed in CISA KEV.

Technical ContextAI

CloudClassroom-PHP Project is a PHP-based educational/classroom management web application developed by vishalmathur, with the sole confirmed affected version being v1.0 (CPE: cpe:2.3:a:vishalmathur:cloudclassroom-php_project:1.0). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which occurs when user-supplied input - in this case the viewid HTTP parameter - is concatenated directly into a SQL query without parameterization or sufficient sanitization. PHP applications using legacy database interaction patterns (e.g., direct string interpolation with mysql_query or similar) are archetypal CWE-89 hosts. Because no input filtering or prepared statements intercept the viewid value before query execution, an attacker can inject arbitrary SQL clauses.

RemediationAI

No vendor-released patch has been identified at time of analysis for CloudClassroom-PHP Project v1.0 - no official advisory exists and no fix version is documented in NVD or the reference. The primary recommended remediation is to replace all direct SQL string concatenation involving the viewid parameter with parameterized queries or prepared statements (e.g., PDO or MySQLi with bound parameters), which eliminates the injection surface entirely. As a compensating control, deploy a Web Application Firewall (WAF) rule set targeting SQLi patterns on the affected endpoint, noting that WAF rules can be bypassed by determined attackers and are not a substitute for code-level fixes. Additionally, restrict public access to the application via IP allowlisting if only internal users require access, which reduces the attack surface by removing the AV:N exposure. Disabling or removing the affected viewid functionality entirely is a viable short-term measure if the feature is non-essential. Refer to the POC at https://github.com/mr-xmen786/CVE-2025-44608 to identify and test the specific vulnerable code path.