EUVD-2026-88143
GHSA-4pp4-2vfh-vg9j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach updateresultdetails.php over HTTP
-
DeliveryInject SQL payload via editid parameter
-
ExploitBackend concatenates into query
-
ExecutionDatabase reads/writes execute
-
ImpactExfiltrate or tamper with stored records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a network-reachable deployment of CloudClassroom-PHP-Project exposing updateresultdetails.php, with a crafted 'editid' parameter as the injection point. The vendor scores PR:N (no authentication) and UI:N (no user interaction), implying default reachability, but because the endpoint is an update/edit function this authentication-free access is vendor-claimed and not independently confirmed. The primary practical limit is deployment scarcity: this is an unmaintained hobby project with no versioning and no vendor patch, so real exposure is confined to the few self-hosted instances that exist. |
| Impact | This is a high-CVSS-technical-severity but low-real-world-priority issue. The CWE-89 SQL injection carries a network vector with low complexity and no user interaction (AV:N/AC:L/UI:N), and the vendor's CVSS 4.0 vector asserts PR:N (unauthenticated); a public exploit exists (E:P) and the description confirms public disclosure. However, several dampening signals dominate: no EPSS score is provided, the issue is NOT in CISA KEV, and the only reporting source is VulDB (410883) with a single third-party GitHub advisory - the typical fingerprint of a low-visibility disclosure against an obscure hobby project. The vendor's own severity is a modest 5.5 because it scores confidentiality/integrity/availability all as Low (VC/VI/VA:L), which understates a classic SQLi that would normally yield high confidentiality impact via database dump; my independent assessment rates it higher (~8.2) on impact but the real-world footprint is tiny. Conflict/uncertainty to flag: the vendor asserts PR:N (unauthenticated), but 'updateresultdetails.php' is functionally a record-update endpoint that in similar apps typically sits behind a login - authentication requirement is NOT independently verifiable from the data, so treat 'unauthenticated' as vendor-claimed, not confirmed. POC availability is NOT evidence of active exploitation. |
| Exploit ScenarioDerived | A remote attacker sends a crafted value in the 'editid' parameter to updateresultdetails.php, injecting SQL that the application concatenates unsanitized into a query, allowing extraction or manipulation of the results/grades database. A public proof-of-concept advisory exists on GitHub (vinniboy021-blip), lowering the skill needed; the CVSS network vector with low complexity means the request can be issued directly over HTTP. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
SQL injection in the updateresultdetails.php script of the CloudClassroom-PHP-Project allows remote attackers to manipulate the 'editid' parameter and potentially read or modify database contents. The vulnerability is confirmed by publicly available exploit code, and the vendor has not responded to disclosure, leaving all versions affected because the project lacks versioning. Despite a high technical severity (assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), real-world risk is low due to the project's limited deployment as an unmaintained hobby application.
RemediationAI
No vendor-released patch is available, and because the project is unmaintained with no versioning, upgrading is not an option. Compensating controls include restricting network access to updateresultdetails.php via IP allowlisting or HTTP authentication (e.g., through web server configuration or a reverse proxy), acknowledging this may break legitimate update functionality if the script is used by unauthenticated users. Deploy a web application firewall with SQL injection rules to block malicious 'editid' payloads, though WAF bypasses remain possible. If the application is not essential, take it offline. Monitor web server logs for SQL injection attempts against the 'editid' parameter. For developers able to modify code, use parameterized queries and strictly validate the 'editid' input, but this requires custom patching. Consult the VulDB advisory (https://vuldb.com/vuln/410883) and the public exploit write-up (https://github.com/vinniboy021-blip/Advisory/blob/main/updateresultdetails-sqli.md) for further details.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic SQL injection (CWE-89) in a PHP-based web application. The file updateresultdetails.php receives an 'editid' parameter that is not properly neutralized before being incorporated into an SQL query, allowing an attacker to inject arbitrary SQL commands. This affects the CloudClassroom-PHP-Project (CPE: cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*), which is a small, unmaintained project without versioning. The attack is network-reachable and, per the assessed CVSS vector (PR:N), unauthenticated; however, the update/edit nature of the endpoint makes this authentication-free access vendor-claimed and not independently confirmed. Successful exploitation could lead to unauthorized data disclosure, modification, or deletion, consistent with the assessed impact (C:H/I:L/A:L). Public exploit code is available, but there is no indication of active exploitation in the wild.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network SQLi with low complexity and no interaction; PR:N follows the vendor claim (though auth is unverifiable), and C:H reflects typical full database read via injection with lesser I/A impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updateresultdetails.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB