The vulnerability is in an unspecified function of updatequery.php where the gid parameter is inserted into SQL statements without validation, allowing an attacker to inject arbitrary SQL code. This injection can be executed on the database server, letting the attacker read or modify sensitive data, alter application state, or cause denial of service. The flaw aligns with CWE‑74 and CWE‑89, describing improper neutralization of SQL special elements and general SQL injection.

The CloudClassroom‑PHP‑Project from mathurvishal is affected. All code versions up to the commit hash 5dadec098bfbbf3300d60c3494db3fb95b66e7be contain the flaw, and no fixed or updated releases have been publicly released. Continuous delivery with rolling releases means newer builds may still be vulnerable if the code is not patched. The vendor has not provided a patch or responded to disclosure efforts.

The CVSS score of 6.9 rates the vulnerability as medium severity with remote attack potential. EPSS data is not available, but the vulnerability was publicly disclosed and a standard exploitation path can be exercised immediately. The flaw is not listed in the CISA KEV catalog, yet the existence of an openly documented exploit suggests that attackers could automate abusing the injection. Because the exploit is reachable from the internet, the risk is elevated for any exposed deployment.