Description

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the file managevideos2.php of the component Faculty Video Management. Such manipulation of the argument V_Title/V_Url/V_Remarks leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-26T08:16:32.133Z",
  "pubdate": "2026-09-26T08:16:32.133Z",
  "executiveSummary": "The CloudClassroom-PHP-Project, specifically the Faculty Video Management component, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from inadequate input validation and output encoding within the managevideos2.php file. By manipulating the V_Title, V_Url, or V_Remarks arguments, an unauthenticated or authenticated remote attacker can inject malicious client-side scripts into the application's database.\nWhen other users, such as faculty members or administrators, view the affected video records, the injected payload is rendered by their browsers within the context of the application session. This compromise allows for the unauthorized execution of arbitrary JavaScript, potentially leading to session hijacking, credential theft, sensitive data exposure, or unauthorized actions performed on behalf of the victim. Given that the vendor has not provided a resolution, the product remains at high risk. Exploitation is feasible remotely and does not require complex prerequisites, making this a critical concern for deployments relying on the affected codebase up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be.",
  "technicalDetails": "The vulnerability resides in the managevideos2.php component, which handles the faculty video management module. The root cause is the failure of the application to sanitize or escape user-supplied data transmitted via the HTTP POST requests associated with video metadata fields, specifically V_Title, V_Url, and V_Remarks. The application directly processes these inputs and persists them into the backend database without implementing server-side input validation or context-aware output encoding.\nExploitation follows a predictable path: an attacker identifies the video management interface where video metadata is submitted. The attacker crafts a malicious payload—typically containing HTML tags such as <script> or event handlers like onerror or onload within attribute values—and injects this into the V_Title, V_Url, or V_Remarks fields. Upon submission, the application accepts the tainted input and stores it permanently within the database.\nWhen a legitimate user or administrator navigates to the video management dashboard to review or manage content, the application retrieves the stored, malicious data and reflects it back to the victim's browser without appropriate character escaping. Because the browser interprets the injected content as part of the document structure, the embedded script executes within the security origin of the application. This context permits the script to access the Document Object Model (DOM), intercept session cookies (if not marked with the HttpOnly flag), and perform authenticated requests on behalf of the victim.\nThis vulnerability is classified as Stored XSS because the payload is persistent; the attack does not require repeated interaction from the attacker after the initial injection, as the payload remains dormant in the database until retrieved. The impact is significant, as it facilitates the bypassing of Same-Origin Policy (SOP) protections, enabling attackers to scrape sensitive information displayed on the page or redirect users to malicious domains. The vulnerability is exploitable remotely, and because the application utilizes a rolling release system, users are encouraged to treat all instances up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be as vulnerable."
}