The flaw resides in the updatedetailsfromfaculty.php module of the CloudClassroom‑PHP‑Project, where the myfid argument is incorporated into a database query without adequate sanitization. This permits an attacker to inject arbitrary SQL statements, potentially allowing them to read, modify, or delete sensitive data in the backend database. The vulnerability is a classic instance of SQL injection (CWE‑74 / CWE‑89) and can compromise confidentiality, integrity, and availability of the application data.

Affected is the CloudClassroom‑PHP‑Project developed by mathurvishal. No specific version numbers are provided due to the project’s rolling release model, but the commit identifier 5dadec098bfbbf3300d60c3494db3fb95b66e7be is known to contain the flaw. The vendor has not released a public fix and has not responded to remediation inquiries.

The CVSS score of 6.9 classifies the vulnerability as medium severity. EPSS information is unavailable, and the issue is not included in the CISA KEV catalog, indicating limited evidence of active exploitation. However, the attack can be launched remotely by supplying a crafted myfid parameter in a request to updatedetailsfromfaculty.php, making the risk tangible for exposed installations.