EUVD-2026-87252
GHSA-87ww-qgg4-mg73
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryReach managevideos2.php endpoint
-
ExploitInject SQL via editassid parameter
-
ExecutionManipulate backend query
-
ImpactRead or alter database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session (CVSS PR:L) on a CloudClassroom-PHP-Project instance; the attacker must be able to reach managevideos2.php and supply the editassid parameter, which is passed into a SQL query without adequate sanitization. Remotely exploitable over the network (AV:N) with low complexity (AC:L) and no user interaction. Limiting factors: valid low-privilege credentials are needed, and because this is a rolling-release project with no official fix, exposure depends on whether an operator has deployed this niche application at all. No non-default configuration is required beyond having the video-management functionality present. |
| Impact | The signals converge on a low real-world priority despite this being a genuine SQL injection (CWE-89). The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N with VC:L/VI:L/VA:L) yields only 2.1 because VulDB scored the confidentiality/integrity/availability impacts as Low rather than High - a conservative rating for injection, but consistent with a small single-purpose app. Exploitation status: publicly available exploit code exists (referenced GitHub PoC by Rita-Cerejo), and E:P (Proof-of-Concept) in the vector corroborates this - but this is NOT active exploitation; there is no CISA KEV listing and no EPSS score was supplied. The PR:L metric indicates authentication is required, which materially limits opportunistic abuse. The strongest mitigating factor is prevalence: CloudClassroom-PHP-Project is an obscure individual-developer GitHub project with negligible production footprint. Net: a real but low-severity, authenticated flaw in a rarely deployed product - not an urgent priority. Note the vendor did not respond to disclosure, so no official patch exists (rolling-release, no version numbers). |
| Exploit ScenarioDerived | An authenticated user of a CloudClassroom-PHP-Project deployment sends a crafted value in the editassid parameter to managevideos2.php, injecting SQL that the application concatenates into a query. A public proof-of-concept exists (GitHub, VulDB 409905), lowering the skill needed to reproduce database reads or manipulation. Given AC:L, exploitation is straightforward once the attacker has the low-privilege access PR:L requires. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
SQL injection in the editassid parameter of managevideos2.php in mathurvishal's CloudClassroom-PHP-Project lets an authenticated low-privilege user supply crafted input that is concatenated into a backend SQL query, allowing them to read from or modify the application's database. Publicly available exploit code exists (a proof-of-concept write-up is linked from the references), but there is no confirmed active exploitation in the wild and no CISA KEV listing; the provided CVSS 4.0 score is 2.1 and the independent re-assessment scores it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, treating it as a low real-world priority because valid credentials and a deployed instance of this niche, rolling-release PHP application are both required. The maintainer was contacted about the flaw and did not respond, and because the project ships as a rolling release there is no versioned affected or fixed release to point to.
RemediationAI
No vendor-released patch identified at time of analysis: the maintainer was contacted and did not respond, and the project's rolling-release model means no fixed version exists to upgrade to, so pulling the newest commit offers no guaranteed fix. The most direct fix is to patch the code locally in managevideos2.php by replacing the string-concatenated query on editassid with a parameterized statement (PDO or mysqli prepared statements) or, at minimum, by strict integer casting and validation of editassid; because there is no upstream release, that change must be maintained as a local fork and re-applied on every upstream pull. If you cannot patch immediately, compensating controls with their trade-offs are: restrict access to managevideos2.php and the rest of the video-management functionality to trusted, authenticated roles only (this reduces the pool of PR:L attackers but does not eliminate the flaw for legitimate users who are malicious or whose accounts are stolen); place a WAF or reverse-proxy rule in front of the app that rejects SQL metacharacters in editassid (bypasses are common for hand-rolled filters and legitimate numeric input may need allow-listing); and run the application against a least-privilege database account so a successful injection cannot read or write beyond the classroom schema. If the application is not actively used, taking it offline or removing the video-management module is the cleanest mitigation. Monitor web server and database logs for anomalous editassid values and unusual SQL errors, and treat the public exploit write-up as a signal that opportunistic scanning of exposed instances is likely.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, SQL injection, in a PHP web application: the video-management script managevideos2.php takes the user-supplied editassid argument and places it into a SQL statement without adequate sanitization or parameter binding, so attacker-controlled characters can alter query structure. The affected code lives in a student/academic-style PHP classroom management project (CloudClassroom-PHP-Project, CPE cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*), which is served over HTTP and typically backed by a MySQL/MariaDB database; the CPE uses a wildcard version because the project follows a rolling-release model with no tagged versions of either affected or updated code. Exploitation is remote (AV:N) with low attack complexity (AC:L) and no user interaction, but the CVSS 4.0 and independent 3.1 vectors both require low privileges (PR:L), meaning the attacker must already hold a valid session that can reach the video-management functionality before the injectable parameter can be abused. Impact is bounded to the application's own database context in the assessed vector (scope unchanged, low confidentiality, integrity and availability impact), rather than extending to the underlying host.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Authenticated (PR:L) network SQLi with low complexity; VulDB rates each impact Low, so C/I/A:L rather than H, and scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file managevideos2.php. Such manipulation of the argument editassid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB