EUVD-2026-88008
GHSA-cr86-p989-h3gg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed addnewstudent.php
-
ExploitSend crafted parameter with SQL payload
-
ExecutionInjected SQL executes in database query
-
ImpactExtract or alter database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a network-reachable deployment of CloudClassroom-PHP-Project with the addnewstudent.php endpoint accessible and backed by a database. The CVSS vector claims no authentication (PR:N) and no user interaction, implying exploitation against a default deployment; however, the endpoint name ('add new student') suggests it may sit behind an administrative login in practice, which would raise the real privilege bar - verify auth placement in the source. Primary limiting factor is deployment scarcity: this is an unversioned hobby PHP project with no packaged releases and an unresponsive vendor, so exploitable instances in production are expected to be extremely rare. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated SQL injection, which on paper is a serious exposure; the vendor-assigned 6.9 is moderated only by the partial-impact ratings (VC:L/VI:L/VA:L) VulDB applies to such disclosures. A public exploit exists (E:P and a GitHub advisory), so exploit availability is confirmed, but there is NO EPSS score and NO CISA KEV listing, meaning there is no evidence of active or widespread exploitation - the signal is 'code is available' not 'attackers are using it.' The dominant risk-reducer here is not the technical flaw (SQLi is high-value) but the target: mathurvishal CloudClassroom-PHP-Project is an unversioned hobby/teaching PHP project on GitHub using a rolling-release model, with an unresponsive vendor and no fix, so real-world production footprint is negligible. Net: a genuinely exploitable, POC-backed unauthenticated SQLi that rates LOW real-world priority because of near-zero deployment, not because the bug is weak. CONFLICT TO NOTE: the CVSS vector asserts PR:N (unauthenticated), yet 'addnewstudent.php' is plausibly a post-login administrative function - auth requirement could not be verified from the provided data and should be confirmed against the source. |
| Exploit ScenarioDerived | A remote attacker sends a crafted HTTP request to addnewstudent.php with a malicious parameter value that is concatenated into a SQL query, injecting attacker-controlled SQL. A public exploit advisory (github.com/vinniboy021-blip/Advisory) already documents the injection point, lowering the effort to reproduce, allowing the attacker to read or manipulate the backing database (e.g., student records and credentials). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
SQL injection in the addnewstudent.php endpoint of mathurvishal's CloudClassroom-PHP-Project lets remote attackers inject arbitrary SQL via user-supplied input, with the disclosed vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N, base 6.9) and our assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N both indicating no authentication barrier and a high confidentiality impact, with integrity loss limited to portions of the database reachable by the application's DB account. Publicly available exploit code exists: a proof-of-concept write-up was published on GitHub (vinniboy021-blip/Advisory, addnewstudent-sqli.md) complementing the VulDB entry, so the skill needed to weaponize the flaw is low, although there is no CISA KEV entry confirming active exploitation and no EPSS score was supplied. Practical exposure is heavily constrained because this is an unversioned, hobby-grade PHP project with no packaged releases, an unresponsive vendor, and an addnewstudent endpoint that in a real deployment may sit behind an administrative login even though the vector claims PR:N.
RemediationAI
No vendor-released patch has been identified at time of analysis: the vendor was contacted early in the disclosure process and did not respond, the project ships no versioned releases, and none of the available references point to a fixed commit, tag, or advisory, so remediation must be handled by the deploying organization. The most direct code-level fix is to rewrite the addnewstudent.php database access so that user-supplied values are bound through prepared statements (PDO or mysqli with parameter binding) rather than concatenated into SQL, and to apply the same treatment to every other script in the project that touches the database, since the disclosed defect is likely representative rather than isolated. If the code cannot be modified immediately, the highest-value compensating control is to disable or remove addnewstudent.php from any internet-facing deployment until it can be fixed - the trade-off is that the student-creation feature becomes unavailable - or, if that feature must stay reachable, place it behind authentication and restrict access to trusted administrative networks or source IP ranges, accepting that this conflicts with the PR:N rating and will break any workflow that relies on unauthenticated front-end submission. A reverse proxy or WAF rule that rejects requests containing SQL metacharacters in addnewstudent.php parameters provides a useful but bypassable stopgap, whereas running the application against a least-privilege database account limited to its own schema reduces the blast radius of a successful injection and should be treated as an operational baseline, not a substitute for the code fix. Finally, because exploit code is publicly available, log and monitor POST requests to addnewstudent.php for SQL syntax fragments or error-triggering payloads, and treat any instance of this project reachable from the internet as a candidate for decommissioning given the unmaintained status and unresponsive vendor.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a classic CWE-89 improper neutralization of special elements used in an SQL command, occurring in the PHP script addnewstudent.php inside mathurvishal's CloudClassroom-PHP-Project. In this class of bug, an application takes a parameter submitted over HTTP and concatenates it directly into a SQL statement instead of using bound parameters, so an attacker can alter the query's structure - appending UNION SELECT clauses, boolean or time-based conditions, or stacked statements depending on the MySQL/PDO driver configuration - to extract rows, modify records, or, if the database account is over-privileged, tamper with other tables. The vulnerable code path requires a network-reachable instance of the application with the addnewstudent.php endpoint exposed and backed by a working database, because the injection is only meaningful when the server relays the tainted string to the DBMS. The CPE entry cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:* carries a wildcard version, reflecting the project's rolling-release model in which no tagged or packaged versions are published, and the disclosure record pins the affected code as everything up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The specific vulnerable function inside addnewstudent.php was not named in the advisory, so defenders must audit the whole file; the SQLi sits in the server-side PHP tier, not in the browser, and exploitation is independent of user interaction (UI:N) per the supplied vectors.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network, low-complexity SQLi with CVSS-asserted no-auth (PR:N, unverified); C:H for full DB read via injection, I:L for limited write, A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file addnewstudent.php. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB