CloudClassroom-PHP-Project Multiple Vulnerabilities

Unauthenticated SQL injection in mathurvishal's CloudClassroom-PHP-Project lets remote attackers manipulate the eid parameter of viewquery.php to alter the SQL query the application executes, exposing and potentially modifying data stored by the classroom application. The flaw is remotely reachable without credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), but impact is scored as limited confidentiality and integrity loss rather than full compromise; the product is a niche individual open-source project, so real-world exposure depends on whether an instance is network-accessible. A public PoC reference exists; it is not verified as working exploit code, the issue is not on CISA KEV, and the vendor did not respond to disclosure and ships a rolling release, so no version-specific fix information is available.

CloudClassroom-PHP-Project exposes protected student records through studentdetails.php because the script continues executing after an access-control redirect (CWE-698). The endpoint is network-reachable with low complexity and no authentication or user interaction per the assessed vector, but impact is limited to low-grade confidentiality loss and the project has a tiny rolling-release footprint. A public PoC reference exists; it is not verified as working exploit code, and no vendor-released fixed version is identified.

Insufficient session expiration in the CloudClassroom-PHP-Project Global Session Handler (CWE-613) lets a session that should be terminated keep working after logout, so anyone already holding a live session identifier can continue to reach the associated account's data. Because the project ships on a rolling-release basis, no affected or fixed version numbers exist - the CPE is a wildcard covering all deployments - and the vendor did not respond to the disclosure. Impact is deliberately scoped: low confidentiality only (VC:L, no integrity or availability effect), remote but high complexity (AC:H), and a public proof-of-concept reference exists but is not verified as working exploit code; there is no KEV (CISA) entry and no confirmed active exploitation, and the reporter rates practical exploitability as difficult because a valid session token must be obtained first.

Cross-site scripting in CloudClassroom-PHP-Project's updatedetailsfromfaculty.php allows remote attackers to manipulate the fname argument and inject script that executes when a victim loads the page where the value is rendered. The referenced advisory describes a stored-XSS condition, and a public PoC reference exists; it is not verified as working exploit code. No CISA KEV confirmation or EPSS score was supplied, and the assessed severity is low, with exploitation requiring user interaction and possible authentication ambiguity at the faculty detail-update endpoint.