Description

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromstudent.php. The manipulation of the argument eno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-26T12:17:35.227Z",
  "pubdate": "2026-09-26T12:17:35.227Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the mathurvishal CloudClassroom-PHP-Project, specifically impacting the updatedetailsfromstudent.php file.\nThe vulnerability arises from improper sanitization of the 'eno' argument, allowing an unauthenticated remote attacker to manipulate database queries.\nSuccessful exploitation permits unauthorized access to the underlying database, potentially leading to data exfiltration, unauthorized modification of records, or administrative control over the application's data layer.\nGiven that the project utilizes continuous delivery with rolling releases, no specific patched version is available, and the lack of vendor response exacerbates the risk.\nThis vulnerability is critical due to the ease of remote exploitation and the potential for full database compromise.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located in the updatedetailsfromstudent.php script within the mathurvishal CloudClassroom-PHP-Project repository (up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be).\nThe root cause is the failure of the application to properly sanitize or parameterize the 'eno' input argument before incorporating it into a SQL query string. This input is processed by the backend database management system without adequate boundary checking.\nAn attacker can exploit this by injecting malicious SQL statements into the 'eno' parameter. By supplying crafted input, the attacker can break the intended logic of the SQL statement. For example, if the script executes a query like 'UPDATE students SET ... WHERE eno = ' + $_GET['eno'], an attacker could provide an input such as '1' OR '1'='1', which alters the query's behavior.\nThe attack flow follows these steps: 1. The attacker targets the updatedetailsfromstudent.php endpoint. 2. The attacker crafts a malicious request containing a modified 'eno' argument embedded with SQL syntax. 3. The server-side PHP script receives this unsanitized input and directly concatenates it into a database query. 4. The database executes the resulting malicious query.\nBecause the application performs no validation on the 'eno' input, an attacker can perform various malicious operations, such as extracting sensitive user information (e.g., student records, credentials), modifying existing database data to escalate privileges, or dropping tables to cause a denial-of-service condition.\nThe attack is initiated remotely and does not require local access, making it highly accessible to external threat actors. Given the continuous delivery model and lack of vendor response, the vulnerability remains active in the current deployment stream."
}