EUVD-2025-16669
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0. The pass parameter is vulnerable due to improper input validation, allowing attackers to inject SQL queries.
Analysis
SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0, where the 'pass' parameter fails to properly validate user input, allowing unauthenticated attackers to inject arbitrary SQL queries over the network. This vulnerability can lead to confidentiality, integrity, and availability compromise with a CVSS score of 7.3 (High), though active exploitation status and proof-of-concept availability could not be verified from the provided data.
Technical Context
The vulnerability exists in a PHP-based web application (CloudClassroom-PHP-Project) at the registrationform endpoint. The root cause is CWE-89 (SQL Injection), which occurs when user-supplied input from the 'pass' parameter is concatenated directly into SQL queries without proper parameterization, escaping, or prepared statement usage. PHP applications are particularly susceptible to SQL injection when using functions like mysql_query() or mysqli without prepared statements. The registrationform endpoint likely constructs a query such as 'SELECT * FROM users WHERE password = "' + $_POST['pass'] + '"' or similar, allowing attackers to break out of the intended query logic and inject arbitrary SQL syntax (e.g., ' OR '1'='1, UNION-based injection, or time-based blind injection).
Affected Products
CloudClassroom-PHP-Project (['v1.0'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today