CloudClassroom PHP Project EUVD-2026-87247

Exploitation requires reaching the updatefaculty.php script and supplying a malicious fid parameter that is concatenated into a SQL query without sanitization. The endpoint name implies an administrative faculty-management function, so a deployed and reachable CloudClassroom-PHP-Project instance is required; whether prior authentication is needed is not confirmed by the description despite the vector's PR:N. Practical limits: the affected product is an obscure GitHub educational project with negligible production deployment, and no patched release exists (rolling-release, unresponsive vendor), so risk is bounded by the small install base rather than by attack difficulty.

The signals point to a real but low-priority vulnerability. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with E:P and a base score of 5.5 describes a remotely reachable SQL injection, and a public exploit exists (VulDB, plus a GitHub advisory), so this is publicly available exploit code exists rather than mere theory. However, no CISA KEV listing and no EPSS score are provided, meaning there is no evidence of active or widespread exploitation - consistent with an obscure, low-footprint target. The impact metrics are deliberately conservative (VC:L/VI:L/VA:L), which understates typical SQLi potential: a single injectable parameter in a database-backed admin page can often yield full read of the backing database (C:H), so the real confidentiality impact may be higher than the input's 'Low' rating. Note a likely tension in the vector: updatefaculty.php is almost certainly an administrative faculty-management endpoint, which would normally imply authentication (PR:L), yet VulDB scored it PR:N; the description does not confirm the auth state, so the true privilege prerequisite should be verified against the code. Overall: a genuine, exploit-available flaw, but in a rare hobby/educational project, making it low real-world priority despite a moderate CVSS.

A remote attacker sends a crafted value in the fid parameter to updatefaculty.php, injecting SQL that the application concatenates directly into a query. This lets the attacker read or manipulate database contents (faculty, user, and credential records). A public proof-of-concept exploit and advisory are already published on GitHub and VulDB, lowering the skill barrier.