CVE-2026-100875

mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection

View on CVE.org
Published Sep 27, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromfaculty.php. Such manipulation of the argument myfid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The flaw resides in the updatedetailsfromfaculty.php module of the CloudClassroom‑PHP‑Project, where the myfid argument is incorporated into a database query without adequate sanitization. This permits an attacker to inject arbitrary SQL statements, potentially allowing them to read, modify, or delete sensitive data in the backend database. The vulnerability is a classic instance of SQL injection (CWE‑74 / CWE‑89) and can compromise confidentiality, integrity, and availability of the application data.

Affected Systems

Affected is the CloudClassroom‑PHP‑Project developed by mathurvishal. No specific version numbers are provided due to the project’s rolling release model, but the commit identifier 5dadec098bfbbf3300d60c3494db3fb95b66e7be is known to contain the flaw. The vendor has not released a public fix and has not responded to remediation inquiries.

Risk and Exploitability

The CVSS score of 6.9 classifies the vulnerability as medium severity. EPSS information is unavailable, and the issue is not included in the CISA KEV catalog, indicating limited evidence of active exploitation. However, the attack can be launched remotely by supplying a crafted myfid parameter in a request to updatedetailsfromfaculty.php, making the risk tangible for exposed installations.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply input validation and use parameterized queries or prepared statements for all database interactions involving the myfid parameter.
  • Restrict the database user role granted to the web application to the minimum privileges required for normal operation.
  • Deploy a Web Application Firewall or similar rule set to detect and block suspicious SQL injection patterns targeting the myfid parameter.

Generated by OpenCVE AI on September 27, 2026 at 20:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromfaculty.php. Such manipulation of the argument myfid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
Title mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection
First Time appeared Mathurvishal
Mathurvishal cloudclassroom-php-project
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*
Vendors & Products Mathurvishal
Mathurvishal cloudclassroom-php-project
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 28, 2026, 1:02 PM
Reserved
Sep 27, 2026, 3:27 AM

View source JSON

Updated
Sep 28, 2026, 1:02 PM

JSON

Status
Deferred
Published
Sep 27, 2026, 7:16 PM
Modified
Sep 28, 2026, 3:16 PM

View source JSON

No data.

Updated
Sep 27, 2026, 9:00 PM

JSON