EUVD-2026-87548
GHSA-rcwr-8jww-gc9q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach updatedetailsfromstudent.php endpoint
-
ExploitInject SQL via 'eno' parameter
-
ExecutionBackend executes tainted query
-
ImpactRead or alter database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the ability to send an HTTP request to the updatedetailsfromstudent.php endpoint of a deployed CloudClassroom-PHP-Project instance with attacker-controlled input in the 'eno' parameter. Vendor scoring implies no authentication or user interaction (PR:N/UI:N), but the endpoint's name suggests a logged-in student/admin record-update workflow, so a valid session may in practice be required - this limiting factor is unverified. No non-default configuration is called out; because releases are rolling with no versioning, defenders cannot pin exposure to a specific build, and no vendor patch is available. |
| Impact | This is a genuine but low-priority SQL injection (CWE-89) in a niche, non-commercial PHP application. The vendor's CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N with VC:L/VI:L/VA:L, score 6.9) describes network-reachable, low-complexity, unauthenticated exploitation with limited-but-triple impact - consistent with an injectable parameter that yields partial read/write/availability effects rather than full database compromise. A publicly available exploit exists (VulDB CTI marks E:P / Proof-of-Concept), which raises practical concern, but there is NO EPSS score and NO CISA KEV listing provided, so there is no evidence of active or widespread exploitation. Signals therefore point to a real, easily-triggered flaw with public POC code, offset by an obscure product with minimal deployment. NOTE a conflict to verify: the vendor rates PR:N (unauthenticated), yet 'updatedetailsfromstudent.php' semantically implies a post-login student-record update flow - the true privilege requirement is not confirmable from the description and should be verified against the source; if authentication is in fact required, real risk drops further. |
| Exploit ScenarioDerived | A remote attacker sends a crafted HTTP request to updatedetailsfromstudent.php with a malicious value in the 'eno' parameter, injecting SQL that the backend executes against the database. A working proof-of-concept is publicly published (github.com/vinniboy021-blip/Advisory), so exploitation requires little skill; because CVSS marks AC:L and (per vendor) PR:N, the request can be issued with low complexity and, if the flaw is truly unauthenticated, without credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
SQL injection in the 'eno' parameter handled by updatedetailsfromstudent.php in mathurvishal's CloudClassroom-PHP-Project lets remote attackers inject arbitrary SQL into the application's database queries, with limited confidentiality, integrity, and availability impact (CVSS 4.0 base 6.9; our independent assessment scores it 6.1 under CVSS 3.1). The project uses rolling releases with no version tags, so no fixed build or specific affected release can be pinned, and the maintainer was contacted but did not respond, leaving no vendor patch. Publicly available exploit code exists, including a GitHub advisory with a proof-of-concept; there is no confirmation of active exploitation (not in CISA KEV). This is a genuine but low-priority issue confined to a niche, non-commercial PHP application.
RemediationAI
No vendor-released patch was identified at time of analysis - the maintainer was contacted early and did not respond, and the rolling-release model provides no fixed version to upgrade to, so remediation must be defensive. The most durable fix is to correct the application code yourself: replace string-concatenated SQL in updatedetailsfromstudent.php with parameterized/prepared statements (PDO or mysqli) and validate that 'eno' is an integer or strict allow-listed value before use; if you maintain a fork, this is the only complete remedy. As compensating controls, deploy a WAF or reverse-proxy rule that blocks SQL metacharacters and injection patterns on requests to updatedetailsfromstudent.php (effective against commodity scanners, but bypassable by determined attackers and prone to false positives in the 'eno' field); require and enforce an authenticated session and appropriate role for this endpoint, which also mitigates the unverified authentication prerequisite (though the vendor vector treats the issue as PR:N, so this may not fully close the gap); and restrict network access to the endpoint - place the application behind a VPN, IP allow-list, or reverse-proxy authentication so only trusted student/administrator networks can reach it (strongly reduces exposure but degrades usability for legitimate remote users). Because no version boundary exists, treat patch-tracking and SBOM-driven remediation as inapplicable and instead audit every deployed copy of the script directly.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic SQL injection (CWE-89) in a PHP web application. User-supplied input to the 'eno' argument of updatedetailsfromstudent.php is incorporated into a database query without adequate sanitization or parameterization, allowing an attacker to alter query structure and read or modify backend data. CloudClassroom-PHP-Project is an educational, community-maintained PHP application distributed via a rolling-release repository rather than tagged versions; the CPE cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:* matches any build, reflecting that no version boundary can be drawn. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) indicates a network-reachable, low-complexity attack with Proof-of-Concept maturity and only low-level impact across C/I/A. Our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) agrees on scope and impact; however, the endpoint name suggests a logged-in record-update workflow, so a valid session may in practice be required even though the vendor vector marks PR:N - this prerequisite is unverified.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable injectable parameter (AV:N/AC:L); PR:N follows the vendor's unauthenticated claim though the endpoint hints at auth; SQLi yields partial read/write/availability, so C:L/I:L/A:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromstudent.php. The manipulation of the argument eno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB