Description
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-26
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: SQL Injection
Action: Immediate Patch
AI Analysis

Impact

A flaw in the CloudClassroom-PHP-Project’s viewresult.php file allows an attacker to inject arbitrary SQL by manipulating the seno parameter. The injection could enable the attacker to read, modify, or delete database contents. The flaw is a typical application-layer weakness identified as CWE-74 and includes functional aspects of CWE-89.

Affected Systems

The vulnerability affects the mathurvishal CloudClassroom-PHP-Project, specifically any release up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. No earlier patches are available, and there is no information provided about patches in later releases.

Risk and Exploitability

The CVSS base score of 6.9 indicates a moderate risk level. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, but public exploitation code is available. Attackers can exploit the flaw remotely through crafted HTTP requests to the viewresult.php endpoint. Due to the lack of an immediate remedy notice from the vendor and public evidence of exploitation, the risk of compromise remains significant.

Generated by OpenCVE AI on September 26, 2026 at 23:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to the latest CloudClassroom-PHP-Project release that excludes commits up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be
  • If an update is unavailable, restrict public access to viewresult.php or require authentication before allowing any requests to that page
  • Implement input validation or use prepared statements for the seno parameter to eliminate injection vectors

Generated by OpenCVE AI on September 26, 2026 at 23:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Title mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection
First Time appeared Mathurvishal
Mathurvishal cloudclassroom-php-project
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*
Vendors & Products Mathurvishal
Mathurvishal cloudclassroom-php-project
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mathurvishal Cloudclassroom-php-project
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-26T22:00:14.688Z

Reserved: 2026-09-26T06:19:41.956Z

Link: CVE-2026-100739

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-26T22:16:31.207

Modified: 2026-09-26T22:16:31.207

Link: CVE-2026-100739

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T02:45:11Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')