CloudClassroom PHP Project CVE-2026-121502

The exploit targets the deleteid parameter of facultydetails.php in mathurvishal CloudClassroom-PHP-Project; an attacker must be able to reach that specific endpoint over the network and supply a manipulated deleteid value, with no authentication, user interaction, or special configuration stated as required by the supplied CVSS vector (PR:N/UI:N/AC:L). Limiting factors: exploitation is bounded to Low confidentiality/integrity/availability impact; the public PoC is a reference advisory not verified as working exploit code; no specific affected or fixed version is identifiable because of the rolling-release model; and although the page name suggests a faculty/admin function that could be access-controlled in some deployments, the sources do not confirm any such gating.

Signals are mixed and point to a moderate, non-urgent issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, but all three impact metrics are only Low (VC:L/VI:L/VA:L), yielding a base score of 6.9 (Medium). Exploit maturity in the vector is E:P (Proof-of-Concept), consistent with the intelligence that a PoC reference exists but is not verified as working exploit code. The vulnerability is NOT listed in CISA KEV, so there is no confirmed active exploitation, and no EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified here. The vuln.today decision label is 'this_month', i.e. patch on a routine cycle rather than an emergency. Net assessment: this is a genuine but modest-priority SQL injection - the unauthenticated network vector keeps it from being ignorable, but the uniformly Low impacts, the unverified PoC, the absence of KEV/EPSS corroboration, and the obscure target product argue against treating it as a high real-world priority. A caveat: the affected page (facultydetails.php) sounds like a faculty/admin management screen that could in practice sit behind a login, yet the sources do not state any authentication requirement, so the PR:N rating cannot be independently confirmed from the description.

A remote attacker sends a crafted request to facultydetails.php with a malicious value in the deleteid parameter, injecting SQL that the application concatenates into a database query. Because the reported vector requires no authentication or user interaction, the attacker can attempt this directly against an exposed instance to read, alter, or delete database rows. A public PoC reference exists (an advisory on GitHub), but it is not verified as working exploit code.