PHP CVE-2025-45542

The vulnerability exists in a PHP-based web application (CloudClassroom-PHP-Project) at the registrationform endpoint. The root cause is CWE-89 (SQL Injection), which occurs when user-supplied input from the 'pass' parameter is concatenated directly into SQL queries without proper parameterization, escaping, or prepared statement usage. PHP applications are particularly susceptible to SQL injection when using functions like mysql_query() or mysqli without prepared statements. The registrationform endpoint likely constructs a query such as 'SELECT * FROM users WHERE password = "' + $_POST['pass'] + '"' or similar, allowing attackers to break out of the intended query logic and inject arbitrary SQL syntax (e.g., ' OR '1'='1, UNION-based injection, or time-based blind injection).