CloudClassroom PHP Project CVE-2026-100875

Requires the CloudClassroom-PHP-Project application to be deployed and network-reachable, with a request delivering attacker-controlled input to the myfid parameter of updatedetailsfromfaculty.php, which is passed unsanitized into a SQL query. The vendor vector claims no authentication (PR:N) and no user interaction, but the endpoint name (faculty detail update) suggests a faculty session may normally be required - if so, valid faculty credentials would be a limiting prerequisite. No patched release exists because the project is rolling-release and the vendor did not respond, so all deployments tracking the referenced commit or earlier remain exposed.

This is a classic high-volume-disclosure, low-real-priority SQL injection in an obscure hobby project. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N with VC:L/VI:L/VA:L, E:P) rates it 5.5 MEDIUM, which is conservative for a SQL injection - VulDB routinely caps such database-manipulation flaws at Low sub-metrics rather than the C:H typically warranted when injection permits full database read. My independent assessment (CVSS 3.1 ~8.2, C:H) reflects that a working SQLi against the myfid parameter generally exposes the entire backing database. The E:P (Proof-of-Concept) exploit maturity aligns with a public advisory existing (rmsbpro/Advisory + VulDB 410805). However, no EPSS score is provided and the CVE is NOT in CISA KEV, and there is no evidence of active exploitation - the POC availability and active exploitation are distinct signals. The single biggest uncertainty is authentication: the file name updatedetailsfromfaculty.php strongly implies a faculty-facing update workflow that would normally sit behind a login, yet the CVSS vector asserts PR:N (unauthenticated). This cannot be reconciled from the data alone - verify whether the endpoint enforces a session before treating this as remotely reachable by anonymous attackers. Overall: a genuinely exploitable injection class but in a product with negligible production footprint, so real-world priority is LOW despite the injection severity.

A remote attacker sends a crafted request to updatedetailsfromfaculty.php with a malicious payload in the myfid parameter, injecting SQL that the application concatenates directly into a query against the backing database. Because a public proof-of-concept exists (rmsbpro advisory / VulDB 410805), an attacker can adapt it to enumerate or exfiltrate database contents such as student/faculty credentials. Whether anonymous access is possible depends on whether the endpoint enforces a faculty session, which is unconfirmed.