EUVD-2026-87246
GHSA-rm3g-xqgg-rww9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryNavigate to updatestudent.php
-
ExploitInject SQL payload via 'eno' argument
-
ExecutionBackend executes malicious query
-
ImpactRead or modify student database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session (CVSS PR:L) able to reach the Student Update functionality; the attacker sends a request to updatestudent.php with a malicious value in the 'eno' parameter, which is passed unsanitized into a SQL query. Limiting factors: a valid low-privilege login is needed (not fully unauthenticated), the target must be one of the few live deployments of this specific unversioned educational PHP project, and no user interaction is required. There is no official patch since the vendor did not respond, so mitigation depends on parameterizing the query manually or restricting access. |
| Impact | This is a classic high-volume, low-real-priority VulDB disclosure: a SQL injection (CWE-89) in an obscure, unversioned educational GitHub project (mathurvishal/CloudClassroom-PHP-Project). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores only 5.3 (Medium), and the E:P suffix in the vector plus the multi-source data confirm a proof-of-concept exploit is public (linked GitHub README), but there is NO CISA KEV listing and NO EPSS score supplied in the input. Exploitation status is therefore 'publicly available exploit code exists' - this must NOT be conflated with active exploitation. The PR:L metric means an authenticated session is required, which meaningfully limits blast radius, and the vendor-assigned impact is only Low across confidentiality/integrity/availability (VC:L/VI:L/VA:L), which understates typical SQLi (a real injection usually yields at least high confidentiality). The single most important mitigating signal is prevalence: this is a niche, non-productized teaching project with no enterprise footprint, so despite a public POC the real-world exposure is minimal. Net: treat as low operational priority; the public exploit only matters to the handful of live demo/learning deployments of this specific project. |
| Exploit ScenarioDerived | An authenticated user of a CloudClassroom-PHP deployment submits a crafted value in the 'eno' parameter to updatestudent.php, injecting SQL that the application concatenates directly into a query. Because a public POC already exists (linked GitHub README), an attacker can reproduce the injection to read or tamper with student records in the backend database. The attack is remote over the network but requires a valid low-privilege login (PR:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
SQL injection in the updatestudent.php script of mathurvishal's CloudClassroom-PHP-Project lets an authenticated attacker inject arbitrary SQL through the unsanitized 'eno' parameter, allowing them to read or manipulate student records in the underlying database. The product is an unversioned educational PHP project hosted on GitHub, so all commits up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be are presumed affected and no fixed release exists. Publicly available exploit code exists (referenced from a GitHub repository alongside the VulDB entry), the vendor was contacted but never responded, and no CISA KEV entry indicates confirmed active exploitation.
RemediationAI
No vendor-released patch identified at time of analysis: the maintainer was contacted early and did not respond, and the project is unversioned, so no fixed release number can be cited. Because the flaw is a direct SQL injection in updatestudent.php, the effective fix is to rewrite the query using parameterized prepared statements (PDO or mysqli with bound parameters) and to cast the 'eno' argument to an integer before use; this is a code change each deployment must apply themselves. As compensating controls with trade-offs: restrict access to updatestudent.php so that only trusted, authenticated administrative roles can reach it (reduces exposure but does not remove the injection for legitimate low-privilege users), and deploy a WAF rule that blocks SQL metacharacters in the 'eno' parameter (cheap to apply but easily bypassed via encoding and prone to false positives). Given the public exploit code at https://github.com/hofuman/CVE/blob/main/README.md, operators running this project should treat direct internet exposure of the Student Update endpoint as unacceptable until the query is parameterized.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a PHP web application, CloudClassroom-PHP-Project, whose updatestudent.php endpoint handles student record updates. The 'eno' (enrollment number) argument is concatenated into a SQL query without sanitization, the classic CWE-89 improper neutralization of special elements used in SQL. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows the attack is remotely reachable with no special preconditions or user interaction but requires a low-privilege authenticated session, and impact is confined to low confidentiality, integrity, and availability loss within the application's own security scope (SC:N/SI:N/SA:N). The CPE cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:* uses a wildcard version because the upstream project does not practice versioned releases, meaning patch-based version tracking is impossible and the vulnerable code should be identified by commit or file hash instead.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote injection needing a low-privilege login (PR:L), no user interaction; a single vulnerable parameter yields limited but real read/write to the database, so C/I/A each Low.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatestudent.php of the component Student Update Functionality. The manipulation of the argument eno results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB