EUVD-2026-88132
GHSA-pmjh-33rc-9rcr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach makeresult.php over network
-
ExploitInject SQL via makeid parameter
-
ExecutionBackend concatenates into query
-
ImpactExtract database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the makeresult.php endpoint of a CloudClassroom-PHP-Project deployment and the ability to supply the makeid parameter. The vendor vector marks PR:N/UI:N, implying no authentication or user interaction, but the description does not confirm whether this page sits behind a login, so unauthenticated reachability should be validated. Limiting factors: the product is an obscure, unmaintained hobby PHP application with essentially no production deployment, and there is no patched release available (rolling releases, vendor unresponsive), so exposure is confined to the few self-hosted instances that exist. |
| Impact | Signals are consistently modest despite a mid-range score. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:L/VI:L/VA:L, E:P) yields 6.9 by scoring only Low impact across confidentiality/integrity/availability - an understatement for a SQL injection, which typically permits full database read (I would assess C:H). EPSS is not provided and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation. Exploitation status: publicly available exploit code exists (GitHub advisory by vinniboy021-blip) - but POC availability is distinct from active exploitation and must not be conflated. There is no SSVC decision data in the input. The single credible source is VulDB (entry 410882); this is a typical low-profile disclosure against an unmaintained hobby project with an unresponsive vendor and no fixed release. Net: a genuine SQLi flaw but LOW real-world priority, driven almost entirely by the product's negligible deployment footprint rather than any inflated severity. Conflict to note: the vector claims PR:N (unauthenticated) yet the terse description does not confirm whether makeresult.php is reachable pre-authentication - verify with the source before treating as unauthenticated. |
| Exploit ScenarioDerived | A remote attacker sends a crafted value in the makeid parameter to makeresult.php, injecting SQL that the application concatenates into a query, allowing extraction of database contents (e.g., user credentials, student records). A public exploit/advisory already documents the injection point, lowering the skill required. Per the vendor vector this needs no authentication, though that access precondition is not independently confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
SQL injection in the makeresult.php script of mathurvishal's CloudClassroom-PHP-Project lets remote attackers tamper with the makeid parameter and inject arbitrary SQL into the application's database queries. Because the project ships only as a continuously-delivered rolling codebase with no tagged releases, every self-hosted deployment tracking upstream - up to and including commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be - should be considered affected, and publicly available exploit code exists (there is no CISA KEV entry, so active exploitation is not confirmed). The CVSS v4.0 score is 6.9, while our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) weighs confidentiality loss as the dominant impact; overall risk stays moderate because exposure is limited to a small number of hobby/self-hosted instances of an unmaintained PHP application, and the vendor never responded to disclosure.
RemediationAI
No vendor-released patch has been identified at time of analysis: the maintainer was contacted early but never responded, and the project's rolling-release model means no fixed version number or commit has been published, so there is nothing to upgrade to. Because the upstream fix is not available, remediation must be performed locally or through compensating controls. For anyone with a source checkout, the highest-value fix is to patch makeresult.php directly by replacing string-concatenated SQL with a parameterized prepared statement (PDO/mysqli bind parameters) or, if makeid is inherently numeric, by casting it with intval() and validating it before use - this is the only control that removes the vulnerability rather than hiding it, and its trade-off is that it requires maintaining a local fork that will diverge from upstream. If the code cannot be changed, restrict reachability to the endpoint: add web-server or reverse-proxy rules so makeresult.php is only accessible from trusted networks or authenticated sessions, with the side effect that any legitimate workflow depending on open access to that page will break; alternatively front the application with a WAF rule that rejects SQL metacharacters in the makeid parameter, accepting the usual risk of false positives and trivial bypasses via encoding. Deploying the application only on isolated, non-production hosts with a least-privilege database account limits the blast radius but does not fix the injection. Given that publicly available exploit code exists for a product with no maintained release, the safest course for most operators is to remove the application from any internet-facing environment until a patched build is available; monitor https://vuldb.com/vuln/410882 and the CVE record at https://vuldb.com/cve/CVE-2026-101012 for any future upstream fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection in a PHP application: user-controllable input from the makeid argument of makeresult.php is incorporated into a database query without parameterization, prepared statements, or type casting, allowing an attacker to alter query logic and read or manipulate backend data. The CPE entry cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:* uses a wildcard version, which reflects the fact that the project has no versioned releases - it is published with continuous delivery/rolling updates, so the only reliable version anchor is the Git commit (up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be). The endpoint performs a server-side result-generation function, so the injection point is reached over HTTP without any client-side dependency; the supplied CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) indicates network reachability and no required privileges or user interaction, and our independent assessment concurs on network reachability and unauthenticated access per the vector while noting that the disclosure does not actually confirm whether makeresult.php sits behind a login, so real-world unauthenticated reachability should be validated per deployment. Impact is bounded by the low-privilege database account typically used by such hobby applications, but confidentiality exposure (C:H in the assessed vector) is the dominant concern.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network SQLi with no confirmed auth barrier (PR:N per vendor) grants full DB read (C:H); limited write/manipulation (I:L) and possible DoS via query load (A:L).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file makeresult.php. This manipulation of the argument makeid causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB