Description
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-11-02
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Remote SQL Injection
Action: Patch ASAP
AI Analysis

Impact

The vulnerability occurs in the file viewquery.php of CloudClassroom-PHP-Project, where manipulating the eid argument allows SQL injection. This flaw enables attackers to inject arbitrary SQL statements into the backend database, potentially leaking sensitive data, modifying or deleting records, or escalating privileges. It represents a classic input validation failure (CWE-74 / CWE-89).

Affected Systems

The affected product is CloudClassroom-PHP-Project published by mathurvishal. Because the project follows a rolling release model, no specific version numbers are listed, meaning all current releases are vulnerable until a fix is released.

Risk and Exploitability

The CVSS base score of 6.9 indicates a medium severity issue, yet the public exploit and remote attack vector raise the risk level considerably for installations. EPSS information is unavailable, and the vulnerability is not yet listed in the CISA KEV catalog, but the lack of vendor response and the active availability of an exploit suggest that the threat potential remains high.

Generated by OpenCVE AI on November 2, 2026 at 05:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest update to CloudClassroom-PHP-Project once a vendor patch is released
  • Sanitize and validate the eid parameter using parameterized queries or strict input whitelisting
  • Restrict the database user privileges to the minimum required for the application

Generated by OpenCVE AI on November 2, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 04:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Title mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection
First Time appeared Mathurvishal
Mathurvishal cloudclassroom-php-project
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*
Vendors & Products Mathurvishal
Mathurvishal cloudclassroom-php-project
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mathurvishal Cloudclassroom-php-project
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-02T04:30:15.935Z

Reserved: 2026-11-01T15:39:22.231Z

Link: CVE-2026-120342

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-02T05:18:24.310

Modified: 2026-11-02T05:18:24.310

Link: CVE-2026-120342

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T05:30:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')