CloudClassroom-PHP-Project EUVD-2026-87545

Requires the attacker to reach the /updateguest.php endpoint over the network and hold a low-privilege authenticated session (CVSS PR:L), then supply a malicious value in the gname or editassid parameter. No user interaction is required (UI:N). The main limiting factors are: (1) an account/privilege is needed rather than fully anonymous access; (2) the product is a niche GitHub PHP project with very limited real-world deployment; and (3) because it is a rolling release with no vendor response, exposure depends on running an unpatched self-hosted instance reachable to would-be attackers.

This is a low-to-moderate priority issue despite a public exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) describes a network-reachable, low-complexity SQL injection requiring low privileges (PR:L), with only Low impact across confidentiality, integrity, and availability - yielding a modest 5.3 base score. The vendor's inclusion of E:P (Proof-of-Concept) in the vector is consistent with the reported public exploit on GitHub, but E:P/POC availability is NOT active exploitation. No EPSS score and no CISA KEV listing are provided, so there is no evidence of widespread or automated in-the-wild exploitation; the signal is 'exploit code exists' rather than 'being exploited.' The dominant risk-limiter is prevalence: this is an obscure open-source student/hobby PHP project (mathurvishal/CloudClassroom-PHP-Project) with negligible production footprint, so real-world exposure is minimal regardless of the technical flaw. Note also that the vendor uses a rolling release and did not respond to disclosure, so no patched version exists - meaning any affected deployment cannot be trivially remediated by upgrading.

An authenticated user with low privileges submits a crafted value in the gname or editassid parameter to /updateguest.php, which is concatenated into a backend SQL query, allowing the attacker to read or tamper with database contents. A public proof-of-concept exploit is available (GitHub advisory by JaconiasDev), lowering the skill barrier. Because attack complexity is low and the vector is network-based, exploitation is straightforward against any exposed instance where the attacker holds a low-privilege account.