Description
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-26
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Immediate Patch
AI Analysis

Impact

A flaw in the mydetailsfaculty.php file of CloudClassroom‑PHP‑Project allows an attacker to manipulate the myfid argument and cause an SQL injection. The vulnerability is present in an unknown function and can be triggered remotely, enabling an attacker to read, modify or delete data stored in the database. The impact is a loss of data confidentiality and integrity, and potentially availability if destructive queries are used.

Affected Systems

The vulnerability affects the CloudClassroom‑PHP‑Project developed by mathurvishal. No versioning information is available; the affected commit is identified as 5dadec098bfbbf3300d60c3494db3fb95b66e7be, and earlier releases may also be impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity risk. Exploitability is likely high because the attack vector is remote and no authentication requirement is mentioned. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a forged myfid parameter in a request to mydetailsfaculty.php, which is executed directly in the database query.

Generated by OpenCVE AI on September 26, 2026 at 15:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest patch or update to a fixed version of CloudClassroom‑PHP‑Project that sanitizes the myfid parameter and uses prepared statements.
  • If a patch is not available, enforce strict input validation on myfid, allowing only numeric values and rejecting any non‑numeric characters.
  • Implement a web application firewall rule to detect and block SQL injection attempts targeting the myfid parameter.

Generated by OpenCVE AI on September 26, 2026 at 15:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Title mathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injection
First Time appeared Mathurvishal
Mathurvishal cloudclassroom-php-project
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*
Vendors & Products Mathurvishal
Mathurvishal cloudclassroom-php-project
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mathurvishal Cloudclassroom-php-project
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-30T00:35:13.609Z

Reserved: 2026-09-25T19:10:13.204Z

Link: CVE-2026-100315

cve-icon Vulnrichment

Updated: 2026-09-30T00:35:09.910Z

cve-icon NVD

Status : Deferred

Published: 2026-09-26T13:16:36.050

Modified: 2026-09-30T02:16:55.960

Link: CVE-2026-100315

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T18:30:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')