The vulnerability resides in an unspecified function of the studentdetails.php file within the CloudClassroom-PHP-Project. Manipulation of this function allows an attacker to control the redirection target, resulting in the execution of unwanted code after the redirect. The vulnerability permits remote exploitation, meaning a remote attacker can trigger the redirect using crafted input. Though the exact payload is not detailed, the impact is equivalent to a remote code execution opportunity where an attacker could execute arbitrary commands on the affected server.

The affected vendor is mathurvishal, and the impacted product is the CloudClassroom-PHP-Project. No specific version information is provided due to the product’s rolling release model.

The CVSS score of 6.9 indicates a medium severity impact. The EPSS score is not available, which means any exploitation probability estimate is currently unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via the studentdetails.php script, exploiting an insecure redirect mechanism to gain code execution privileges. The lack of an official fix or advisory response from the vendor increases the risk of continued exploitation until a patch or mitigations are applied.