The vulnerability arises in the addnewstudent.php component of the CloudClassroom-PHP-Project, allowing an attacker to inject arbitrary SQL through improperly validated input parameters. This flaw can result in unauthorized queries against the backend database, enabling attackers to read, modify or delete student records and other sensitive data. The associated CWE identifiers indicate an SQL injection and input handling weakness. The CVSS score of 6.9 reflects a moderate overall risk to confidentiality and integrity.

Affected installations include all instances of mathurvishal's CloudClassroom-PHP-Project that contain the code up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Because the project follows a rolling‑release model, a precise list of vulnerable versions is not available; however, any release before this commit is susceptible. The project is hosted on the vendor’s repository, and no official patch is currently posted.

The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been documented. Nevertheless, the published exploit demonstrates that remote attackers can achieve the injection by sending crafted HTTP requests to addnewstudent.php. Based on the description, it is inferred that authentication is not required for the attack. Given the moderate CVSS score and the lack of mitigation controls, the risk level remains significant until the affected component is replaced or hardened.