CloudClassroom-PHP-Project CVE-2026-100873

Exploitation requires an authenticated victim of the CloudClassroom-PHP-Project application to visit an attacker-controlled web page while their session is active (UI:P). The application must lack anti-CSRF token protection on state-changing endpoints (the root cause, CWE-352). No attacker authentication is needed (PR:N), but the attack cannot succeed without a logged-in victim being socially engineered into loading the malicious content, which meaningfully limits real-world exploitability. There is no vendor patch available, as the vendor did not respond to disclosure and the product is unversioned.

This is a high-CVSS-appearance-but-low-real-risk issue. The vendor CVSS 4.0 score of 5.3 (medium) with SSVC exploitation status Proof-of-Concept (E:P) reflects a CSRF flaw with only limited integrity impact (VI:L) and no confidentiality or availability impact. Attack vector is network (AV:N) with low complexity (AC:L) and no privileges required (PR:N), but exploitation requires passive user interaction (UI:P) - a logged-in victim must trigger an attacker-controlled page while authenticated. No EPSS score and no CISA KEV listing are provided, and while a public POC exists (a GitHub advisory writeup), POC availability is NOT the same as active exploitation. Real-world risk is very low: the affected product is an obscure hobby/student PHP project on GitHub with no versioning and no enterprise deployment, and the vendor did not respond to disclosure so no patch exists. This is a typical VulDB disclosure of a minor flaw in an obscure project - the medium CVSS overstates practical risk given the tiny deployment footprint and the need for an authenticated victim to be socially engineered.

An attacker crafts a malicious web page containing a forged request (e.g., an auto-submitting form) targeting a state-changing function of the CloudClassroom-PHP-Project application. When an authenticated user is lured into visiting the page, their browser silently submits the request using their session, causing an unintended state change. A public POC writeup exists (GitHub vinniboy021-blip/Advisory csrf.md), lowering the effort to reproduce.