The flaw arises in CloudClassroom-PHP-Project's updateguest.php. An attacker can manipulate the gname/editassid parameters to inject arbitrary SQL, resulting in a classic SQL injection. The flaw allows remote exploitation as the vulnerable input is processed through a database query without proper sanitization. The result can give the attacker read or modify access to the database, jeopardizing confidentiality and integrity of stored data.

Affected vendors: Mathurvishal; product: CloudClassroom-PHP-Project, all releases up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. No strict version boundaries are specified because the project follows a rolling release model, so any current installation that has not yet applied a vendor fix is considered vulnerable. The only known affected endpoint is the updateguest.php script used by the application.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available and the vulnerability is not yet listed in CISA KEV, but the publicly released exploit and the possibility of remote execution raise the risk. Attackers could leverage this vector over the network to extract or alter sensitive data. The CWE mapping (CWE-74, CWE-89) confirms the weakness lies in unvalidated input leading to SQL injection.