CloudClassroom-PHP-Project EUVD-2026-87210

Exploitation requires only network access to a deployed CloudClassroom-PHP-Project instance exposing the Faculty Authentication page (loginlinkfaculty.php); the attacker manipulates the fid or pass request argument to inject SQL. No authentication, no user interaction, and no non-default configuration are needed - the vulnerable login endpoint is a core part of the application. The primary limiting factor is deployment scarcity: the product is an obscure PHP project with negligible production presence, and no patched release exists because the vendor uses rolling releases and did not respond to disclosure.

The CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N with Low VC/VI/VA) describes a remotely reachable, unauthenticated, low-complexity SQL injection - a genuinely easy-to-reach flaw. The provided vector already carries E:P (Proof-of-Concept exploit maturity), which is corroborated by the multi-source data: a public PoC exists on GitHub (smithbraz/PoC-CloudClassroom-AuthBypass), so exploitability is confirmed at the code level. However, this is NOT CISA KEV-listed and there is no EPSS score supplied, so there is no evidence of widespread or active in-the-wild exploitation. The real-world priority is tempered heavily by product prevalence: mathurvishal CloudClassroom-PHP-Project is an obscure hobby/student PHP application, not enterprise software, so the large-scale exploitation signal is weak despite the trivial attack path. One caveat: the impact metrics are rated Low across the board by VulDB, but a raw SQL injection in an authentication query commonly enables full database read (higher confidentiality) - the actual impact could be understated. Net: technically a real, easily-triggered unauthenticated SQLi with public PoC, but low aggregate risk driven by rare deployment footprint rather than by any mitigating technical factor.

A remote, unauthenticated attacker sends a crafted HTTP request to loginlinkfaculty.php, injecting SQL through the fid or pass parameter of the Faculty Authentication component to bypass the login check or extract database contents. A public proof-of-concept explicitly targeting this authentication bypass is available on GitHub, so no exploit development is required. Given AV:N/AC:L/PR:N/UI:N, the attack is a single unauthenticated web request against a default installation.