CVE-2026-97882

mathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql injection

View on CVE.org
Published Sep 25, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipulation of the argument fid/pass can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability is located in the loginlinkfaculty.php component of CloudClassroom-PHP-Project. It represents a SQL Injection flaw (CWE-89) caused by inadequate input handling and manipulation (CWE-74). Malformed values passed to the parameters fid and pass allow attackers to inject arbitrary SQL; this can enable reading, modifying or deleting data in the backend database, as publicly released exploitation code demonstrates.

Affected Systems

All instances of mathurvishal's CloudClassroom-PHP-Project that incorporate code prior to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be are vulnerable. Because the project follows a rolling-release model, explicit version numbers for patched releases are not provided; any deployment made before the identified commit may still contain the flaw.

Risk and Exploitability

With a CVSS score of 6.9 the vulnerability carries a moderate risk. The EPSS is not published and the issue is not listed in the CISA KEV catalog, yet a publicly available exploit demonstrates the possibility of a remote attack. Until the code is updated or mitigated, the threat remains significant.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict outbound traffic to the loginlinkfaculty.php endpoint, allowing only trusted networks through firewall or reverse-proxy rules.
  • Refactor the handling of fid and pass parameters to use parameterized queries or an ORM, eliminating direct SQL string construction.
  • Apply least-privilege permissions to the database account used by the application and enable query-logging to detect suspicious activity.
  • Upgrade the CloudClassroom-PHP-Project to a commit that removes the vulnerable code; if no such commit is available, consider replacing the affected module with a proven, secure alternative.

Generated by OpenCVE AI on September 25, 2026 at 21:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipulation of the argument fid/pass can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
Title mathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql injection
First Time appeared Mathurvishal
Mathurvishal cloudclassroom-php-project
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*:*:*:*:*:*:*:*
Vendors & Products Mathurvishal
Mathurvishal cloudclassroom-php-project
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 29, 2026, 7:33 PM
Reserved
Sep 25, 2026, 9:05 AM

View source JSON

Updated
Sep 29, 2026, 7:33 PM

JSON

Status
Deferred
Published
Sep 25, 2026, 6:17 PM
Modified
Sep 29, 2026, 8:17 PM

View source JSON

No data.

Updated
Sep 26, 2026, 12:15 PM

JSON