CloudClassroom PHP Project CVE-2026-100894

Requires reaching the updateguest.php endpoint and supplying a crafted 'gname' argument that is concatenated into a SQL statement; per the vendor CVSS vector the attacker needs some level of authenticated/low-privilege access (PR:L), so exploitation is limited to users who can invoke the guest-update function rather than fully anonymous visitors. Practically limiting factors: the product is a niche hobby PHP application with tiny deployment, no released versioned build to target (rolling release), and no vendor patch - but a public PoC advisory (JaconiasDev) reduces attacker effort. The PR:L requirement is not corroborated by the description and should be verified against the actual code, since updateguest.php may or may not enforce a session.

This is a classic VulDB-sourced disclosure against an obscure hobby PHP project (mathurvishal/CloudClassroom-PHP-Project) using a rolling-release model with no discrete version numbers, which itself complicates patch tracking and asset inventory. Signals are mixed-to-low priority: the input CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:L/VI:L/VA:L, score 5.3) implies a network-reachable but authenticated (PR:L) SQL injection with only Low impact across confidentiality/integrity/availability, and E:P (Proof-of-Concept) exploit maturity. A public exploit advisory exists (GitHub JaconiasDev), so publicly available exploit code exists - but this is distinct from active exploitation: there is NO EPSS score provided and NO CISA KEV listing, indicating no evidence of widespread or automated exploitation in the wild. The vendor was contacted and did not respond, so no official fix is confirmed. The most notable conflict is impact rating: the vendor scores all impacts as Low (VC/VI/VA:L), but an unconstrained SQL injection typically enables full database read, which would justify C:H - the true confidentiality impact is likely understated unless the injection point is heavily constrained (e.g., limited to a boolean/blind or ORDER-BY context). Also note the PR:L (authenticated) rating is unverifiable from the terse description, which does not state whether updateguest.php requires a session. Overall this is a low-real-world-priority issue: a niche product, no KEV, no EPSS, only a PoC, tempered by likely-understated confidentiality impact.

An attacker with (per the CVSS vector) low-privilege access to a deployed CloudClassroom-PHP-Project instance submits a crafted value in the 'gname' parameter to updateguest.php, injecting SQL that the application concatenates into a database query. A public exploit advisory is available (GitHub JaconiasDev), lowering the effort to reproduce and enabling extraction or manipulation of guest/database records. Because the app is network-facing, the request can be delivered remotely over HTTP.