CloudClassroom-PHP-Project CVE-2026-120342

The exact prerequisite is a reachable instance of CloudClassroom-PHP-Project exposing viewquery.php, where the eid request parameter is passed unsanitized into a SQL query. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote and unauthenticated against the deployed application with no user interaction required. The primary limiting factors are not configuration-based but deployment-based: the application must be internet- or network-accessible, and the product is a niche individual open-source project rather than widely deployed software. No fixed version exists because the vendor uses a rolling release and did not respond to disclosure, so defenders cannot rely on a vendor patch; mitigation depends on restricting access to or parameterizing the affected endpoint.

This is a remote, unauthenticated SQL injection (CWE-89) in the eid parameter of viewquery.php in mathurvishal's CloudClassroom-PHP-Project. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a low-complexity, network-reachable attack needing no privileges or user interaction, which maximizes ease of exploitation; however, impact is rated only partial across the board (VC:L/VI:L/VA:L), yielding a moderate 6.9 base score. Signals are mixed and point to lower-than-headline real-world risk: the E:P (Proof-of-Concept) exploit maturity and the referenced GitHub advisory indicate exploit material exists, but the input explicitly marks it as a reference not verified as working exploit code, so it is not confirmed weaponized. No CISA KEV listing and no EPSS score are present in the input, so there is no evidence of active exploitation or a quantified exploitation probability. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real but non-urgent issue. The dominant risk-limiting factor is product footprint: this is an individual developer's open-source PHP project, not enterprise software, so widespread opportunistic exploitation is unlikely despite the easy-to-trigger flaw.

A remote attacker sends a crafted HTTP request to viewquery.php with a malicious eid parameter value that is concatenated into a SQL query, injecting attacker-controlled SQL. Because the CVSS vector is PR:N/UI:N, no authentication or victim interaction is required, allowing the attacker to manipulate the backend database query directly. A public PoC reference exists (GitHub advisory); it is not verified as working exploit code.