CVE-2026-100739

mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection

View on CVE.org
Published Sep 26, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A flaw in the CloudClassroom-PHP-Project’s viewresult.php file allows an attacker to inject arbitrary SQL by manipulating the seno parameter. The injection could enable the attacker to read, modify, or delete database contents. The flaw is a typical application-layer weakness identified as CWE-74 and includes functional aspects of CWE-89.

Affected Systems

The vulnerability affects the mathurvishal CloudClassroom-PHP-Project, specifically any release up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. No earlier patches are available, and there is no information provided about patches in later releases.

Risk and Exploitability

The CVSS base score of 6.9 indicates a moderate risk level. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, but public exploitation code is available. Attackers can exploit the flaw remotely through crafted HTTP requests to the viewresult.php endpoint. Due to the lack of an immediate remedy notice from the vendor and public evidence of exploitation, the risk of compromise remains significant.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to the latest CloudClassroom-PHP-Project release that excludes commits up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be
  • If an update is unavailable, restrict public access to viewresult.php or require authentication before allowing any requests to that page
  • Implement input validation or use prepared statements for the seno parameter to eliminate injection vectors

Generated by OpenCVE AI on September 26, 2026 at 23:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Title mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection
First Time appeared Mathurvishal
Mathurvishal cloudclassroom-php-project
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*
Vendors & Products Mathurvishal
Mathurvishal cloudclassroom-php-project
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 28, 2026, 4:54 PM
Reserved
Sep 26, 2026, 6:19 AM

View source JSON

Updated
Sep 28, 2026, 4:54 PM

JSON

Status
Deferred
Published
Sep 26, 2026, 10:16 PM
Modified
Sep 28, 2026, 5:17 PM

View source JSON

No data.

Updated
Sep 27, 2026, 2:45 AM

JSON