Description
A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipulation of the argument fid/pass can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-25
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is located in the loginlinkfaculty.php component of CloudClassroom-PHP-Project. It represents a SQL Injection flaw (CWE-89) caused by inadequate input handling and manipulation (CWE-74). Malformed values passed to the parameters fid and pass allow attackers to inject arbitrary SQL; this can enable reading, modifying or deleting data in the backend database, as publicly released exploitation code demonstrates.

Affected Systems

All instances of mathurvishal's CloudClassroom-PHP-Project that incorporate code prior to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be are vulnerable. Because the project follows a rolling-release model, explicit version numbers for patched releases are not provided; any deployment made before the identified commit may still contain the flaw.

Risk and Exploitability

With a CVSS score of 6.9 the vulnerability carries a moderate risk. The EPSS is not published and the issue is not listed in the CISA KEV catalog, yet a publicly available exploit demonstrates the possibility of a remote attack. Until the code is updated or mitigated, the threat remains significant.

Generated by OpenCVE AI on September 25, 2026 at 21:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict outbound traffic to the loginlinkfaculty.php endpoint, allowing only trusted networks through firewall or reverse-proxy rules.
  • Refactor the handling of fid and pass parameters to use parameterized queries or an ORM, eliminating direct SQL string construction.
  • Apply least-privilege permissions to the database account used by the application and enable query-logging to detect suspicious activity.
  • Upgrade the CloudClassroom-PHP-Project to a commit that removes the vulnerable code; if no such commit is available, consider replacing the affected module with a proven, secure alternative.

Generated by OpenCVE AI on September 25, 2026 at 21:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipulation of the argument fid/pass can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
Title mathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql injection
First Time appeared Mathurvishal
Mathurvishal cloudclassroom-php-project
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*
Vendors & Products Mathurvishal
Mathurvishal cloudclassroom-php-project
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mathurvishal Cloudclassroom-php-project
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-29T19:33:32.236Z

Reserved: 2026-09-25T09:05:35.220Z

Link: CVE-2026-97882

cve-icon Vulnrichment

Updated: 2026-09-29T19:33:27.927Z

cve-icon NVD

Status : Deferred

Published: 2026-09-25T18:17:35.063

Modified: 2026-09-29T20:17:32.080

Link: CVE-2026-97882

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T12:15:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')