What is the CVSS score of EUVD-2024-54626?

EUVD-2024-54626 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2024-54626?

CloudClassroom PHP Project 1.0 contains a SQL injection vulnerability that could allow attackers to extract, modify, or delete sensitive student data stored in the application database.

How to fix or mitigate EUVD-2024-54626?

Within 24 hours: Identify all systems running CloudClassroom PHP Project 1.0 and assess exposure; disable the mydetailsstudent.php functionality if operationally feasible or restrict network access to trusted users only. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns in the myds parameter; conduct database access logs review for suspicious activity. Within 30 days: Evaluate alternative student information systems or contact the vendor for security patches; prepare for potential data breach notification procedures if exploitation is confirmed.

PHP EUVD-2024-54626

| CVE-2024-57459 HIGH

SQL Injection (CWE-89)

2025-06-02 cve@mitre.org

PHP SQLi Cloudclassroom Php Project

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2024-54626

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

CVE Published

Jun 02, 2025 - 16:15 nvd

HIGH 7.3

DescriptionCVE.org

A time-based SQL injection vulnerability exists in mydetailsstudent.php in the CloudClassroom PHP Project 1.0. The myds parameter does not properly validate user input, allowing an attacker to inject arbitrary SQL commands.

AnalysisAI

Time-based SQL injection vulnerability in the mydetailsstudent.php file of CloudClassroom PHP Project version 1.0, where the 'myds' parameter fails to properly validate user input, allowing unauthenticated remote attackers to inject and execute arbitrary SQL commands. The vulnerability has a CVSS score of 7.3 (High), indicating potential for data theft, modification, and service disruption. No KEV status or active exploitation data is provided in the current intelligence; however, the network-accessible nature (CVSS:3.1/AV:N) and low attack complexity suggest this represents a significant real-world risk if the affected application is internet-facing.

Technical ContextAI

The vulnerability exists in CloudClassroom PHP Project 1.0, a PHP-based web application for classroom management. The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection flaw. The mydetailsstudent.php endpoint accepts user input via the 'myds' parameter and incorporates it directly into SQL queries without proper input validation, parameterization, or prepared statement usage. Time-based SQL injection specifically exploits database response delays (using SLEEP() or BENCHMARK() functions) to infer truth values when error-based or UNION-based methods are unavailable, making this a blind injection variant that is slower but harder to detect. The absence of input sanitization or query parameterization in legacy PHP applications like this is typical of outdated code patterns predating modern ORM frameworks and security best practices.

RemediationAI

Immediate mitigation steps: (1) Disable or restrict network access to mydetailsstudent.php via firewall or web application firewall (WAF) rules until patched; (2) Implement input validation and sanitization on the 'myds' parameter to reject SQL metacharacters and enforce expected input format (e.g., alphanumeric-only if applicable); (3) Refactor the mydetailsstudent.php code to use prepared statements with parameterized queries (e.g., PHP PDO with bound parameters or MySQLi prepared statements) instead of string concatenation. Long-term: update to a patched version of CloudClassroom PHP Project when released by the vendor (version number TBD—check project repository). If the project is unmaintained, migrate to an actively supported classroom management system. No specific patch version is provided in the current intelligence; contact the CloudClassroom vendor or check the official repository (GitHub, SourceForge, etc.) for a patched release. Web Application Firewall (WAF) rules targeting SQL injection patterns (e.g., SLEEP, BENCHMARK, UNION SELECT) can provide temporary detection/blocking until code-level fixes are deployed.