Description

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-26T13:16:36.050Z",
  "pubdate": "2026-09-26T13:16:36.050Z",
  "executiveSummary": "The CloudClassroom-PHP-Project, up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be, contains a critical SQL injection vulnerability within the mydetailsfaculty.php component. This flaw arises from the improper sanitization of the 'myfid' input argument, allowing an unauthenticated remote attacker to execute arbitrary SQL commands against the underlying database. The vulnerability poses a significant risk to data confidentiality, integrity, and availability, as it enables unauthorized access to sensitive faculty records, potential modification of database contents, and administrative control over the backend data layer. Given the public availability of exploit code and the lack of vendor response or versioned patches, this vulnerability represents an active security threat to all deployments utilizing the affected codebase.",
  "technicalDetails": "The vulnerability is localized within the file mydetailsfaculty.php, specifically occurring where the 'myfid' parameter is processed. The root cause of this SQL injection is the direct concatenation of user-supplied input into an active SQL query string without adequate parameterized queries or input validation. By manipulating the 'myfid' argument, an attacker can break out of the intended query syntax and append malicious SQL statements.\nThe attack flow commences when an attacker transmits a crafted HTTP GET or POST request containing a malicious payload within the 'myfid' parameter. Because the application fails to use prepared statements, the database driver executes the injected SQL commands as part of the primary query. This allows an attacker to manipulate the query logic, bypass authentication mechanisms, or perform UNION-based queries to exfiltrate sensitive data from other tables within the database schema.\nThe attack is remotely exploitable, requiring no prior authentication or administrative privileges. Since the application does not utilize versioning, all instances up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be are inherently vulnerable. Post-exploitation impact is severe; depending on the database user permissions, an attacker may conduct blind SQL injection to enumerate the database structure, dump entire tables, or in specific configurations, achieve remote code execution by leveraging database functions such as 'SELECT INTO OUTFILE' to write malicious scripts to the server's web root.\nThe lack of vendor intervention necessitates manual remediation at the application level. Until source code changes are implemented to adopt secure coding practices, the vulnerability remains an easily weaponized entry point for unauthorized data access and server-side compromise."
}