What is the CVSS score of CVE-2025-45542?

CVE-2025-45542 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.4%.

Which versions of PHP are affected by CVE-2025-45542?

A SQL injection vulnerability in CloudClassroom-PHP-Project v1.0's registration form could allow attackers to access, modify, or delete sensitive user and academic data without authentication.

Is there a public PoC exploit available for CVE-2025-45542?

Yes, a public proof-of-concept exploit is available for CVE-2025-45542. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-45542?

Within 24 hours: Disable the registration form endpoint or restrict access to trusted networks only; review access logs for exploitation attempts. Within 7 days: Deploy WAF rules to block SQL injection patterns in the 'pass' parameter; conduct forensic analysis of user accounts for unauthorized modifications. Within 30 days: Migrate to a patched version or alternative application; implement comprehensive input validation and parameterized queries across all endpoints.

PHP CVE-2025-45542

EUVD-2025-16669 HIGH

SQL Injection (CWE-89)

2025-06-02 cve@mitre.org

SQLi PHP Cloudclassroom Php Project

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2025-16669

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

PoC Detected

Jun 13, 2025 - 17:45 vuln.today

Public exploit code

CVE Published

Jun 02, 2025 - 16:15 nvd

HIGH 7.3

DescriptionCVE.org

SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0. The pass parameter is vulnerable due to improper input validation, allowing attackers to inject SQL queries.

AnalysisAI

SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0, where the 'pass' parameter fails to properly validate user input, allowing unauthenticated attackers to inject arbitrary SQL queries over the network. This vulnerability can lead to confidentiality, integrity, and availability compromise with a CVSS score of 7.3 (High), though active exploitation status and proof-of-concept availability could not be verified from the provided data.

Technical ContextAI

The vulnerability exists in a PHP-based web application (CloudClassroom-PHP-Project) at the registrationform endpoint. The root cause is CWE-89 (SQL Injection), which occurs when user-supplied input from the 'pass' parameter is concatenated directly into SQL queries without proper parameterization, escaping, or prepared statement usage. PHP applications are particularly susceptible to SQL injection when using functions like mysql_query() or mysqli without prepared statements. The registrationform endpoint likely constructs a query such as 'SELECT * FROM users WHERE password = "' + $_POST['pass'] + '"' or similar, allowing attackers to break out of the intended query logic and inject arbitrary SQL syntax (e.g., ' OR '1'='1, UNION-based injection, or time-based blind injection).