CloudClassroom PHP Project EUVD-2026-87223

Requires a network-reachable deployment of mathurvishal CloudClassroom-PHP-Project exposing updatequery.php; the attacker manipulates the gid request parameter to inject SQL. Per the VulDB CVSS vector (PR:N/UI:N) no authentication or user interaction is asserted, though this auth assumption is not independently confirmed and CloudClassroom pages may sit behind a login in some setups. Practical exploitation is limited chiefly by the product's near-zero deployment footprint and the absence of any fixed release (rolling releases, unresponsive vendor), not by technical complexity.

This is a classic VulDB-catalogued SQL injection (CWE-89) in an obscure student/hobby PHP application, and the real-world risk is LOW despite the network vector. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L, base 6.9) indicates remote, low-complexity, unauthenticated exploitation with only PARTIAL confidentiality/integrity/availability impact - consistent with a single injectable parameter rather than full DB compromise. Signals partly align: SSVC reports Exploitation=poc, Automatable=yes, Technical Impact=partial, and a public exploit exists on GitHub, so weaponization into a spray/scan is technically easy. However, there is NO KEV listing and NO EPSS score provided, and no evidence of active exploitation - so this is 'publicly available exploit code exists,' not confirmed in-the-wild use. The dominant risk-limiter is deployment footprint: this is a tiny GitHub project with negligible production presence, so an automatable, low-privilege SQLi still translates to minimal aggregate exposure. Note the CVSS 4.0 partial-impact ratings (VC:L/VI:L/VA:L) may UNDERSTATE a raw SQLi, which can often read/modify entire tables - verify actual query context against the source; conversely PR:N is asserted by VulDB and not independently confirmed against the application's auth model.

A remote attacker sends a crafted request to updatequery.php with a malicious payload in the gid parameter, injecting SQL that the application concatenates into a query without sanitization. Because a public proof-of-concept advisory exists on GitHub and the flaw is automatable, an attacker can script extraction or tampering of database rows against any exposed instance. Impact per the CVSS vector is partial across confidentiality, integrity, and availability rather than full database takeover.