PHP EUVD-2025-16669

The CVSS 7.3 (High) score reflects a network-accessible vulnerability requiring no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), with low-complexity exploitation enabling partial compromise across confidentiality, integrity, and availability (S:U/C:L/I:L/A:L). The attack surface is significant: any exposed registrationform endpoint is immediately exploitable by unauthenticated users. However, the impact limitation to 'Low' across CIA triad (rather than High) suggests the vulnerability may not grant full database control in a single query, or the application's database user lacks elevated privileges. Without EPSS probability data, KEV/CISA inclusion status, or confirmed public POC availability, real-world exploitation likelihood cannot be precisely quantified, but SQL injection in authentication endpoints historically ranks among the most actively exploited vulnerabilities. The lack of patch version information in the provided data is a critical gap; if no patch exists or the project is unmaintained, real-world risk escalates significantly. Organizations should prioritize remediation if this is a production system or internet-facing application.

An attacker navigates to the CloudClassroom-PHP-Project application and locates the registration form endpoint. Instead of submitting a legitimate password in the 'pass' parameter, the attacker submits a crafted SQL injection payload such as: pass=admin' OR '1'='1' --. The application constructs a query like: 'SELECT * FROM users WHERE username = "admin" AND password = "admin' OR '1'='1' --"', which returns true for all rows, allowing authentication bypass as the admin user. Alternatively, the attacker submits pass=1' UNION SELECT 1,username,password FROM users -- to extract the user database via a UNION-based injection. Since the endpoint requires no authentication (PR:N) and no user interaction (UI:N), the attacker can automate this attack to enumerate users, steal credentials, modify database records (if the injected query includes UPDATE/INSERT), or launch denial-of-service attacks (e.g., DROP TABLE queries). No public POC was confirmed in the provided data, but SQL injection vulnerabilities in PHP are well-documented with readily available exploitation techniques.