PHP CVE-2025-46179

This vulnerability represents critical real-world risk for all CloudClassroom-PHP v1.0 deployments: (1) CVSS 9.8 with vector AV:N/AC:L/PR:N/UI:N indicates maximum attack surface—network-accessible, no authentication/complexity barriers, and universal impact (confidentiality, integrity, availability all high); (2) The CWE-89 classification represents one of the most actively exploited and trivial-to-exploit vulnerability classes; (3) SQL injection in an educational platform exposes sensitive student data, grades, and institutional information; (4) Automatable exploitation is extremely high—standard SQL injection payloads (UNION-based, time-based blind, error-based) apply directly; (5) No patch availability information provided suggests this may be a recently disclosed or abandoned project. While EPSS probability and KEV status are not provided, the combination of trivial exploitability, complete database access potential, and network accessibility makes this an immediate priority despite lack of active-exploitation confirmation. This is NOT a high-CVSS-low-risk scenario—the scoring accurately reflects real exploitability.

An unauthenticated attacker discovers the vulnerable askquery.php endpoint via directory enumeration or reconnaissance. They craft a malicious HTTP request with a SQL injection payload in the 'squeryx' parameter, such as: GET /askquery.php?squeryx=1' UNION SELECT user(),version(),database()-- -. The unsanitized parameter is directly embedded into a backend SQL query (e.g., SELECT * FROM questions WHERE id = [squeryx]), resulting in execution of the injected UNION statement. The attacker extracts database metadata, schema information, and sensitive data. Follow-up exploitation could include: (a) Time-based blind SQL injection to enumerate tables/columns character-by-character; (b) INTO OUTFILE attacks to write webshells to the filesystem; (c) Direct modification of student records, grades, or administrative accounts; (d) Extraction of credential hashes or plaintext passwords if stored in the database. Complete attack chain from reconnaissance to data exfiltration requires <5 minutes with standard SQL injection tools (sqlmap, Burp Suite). No special authentication, social engineering, or user interaction is required.