The vulnerability allows an attacker to inject arbitrary SQL through the eno argument in updatestudent.php. This can lead to disclosure, alteration, or deletion of student information stored in the database, posing a direct risk to confidentiality, integrity, and availability of data.

The vulnerability affects the mathurvishal CloudClassroom-PHP-Project, specifically the Student Update Functionality component updatestudent.php. All versions of the project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be are impacted, as the project does not implement versioning and the exact affected releases cannot be distinguished.

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The attack can be launched remotely, and the exploit is publicly known, increasing the likelihood of exploitation. Since the vendor has not released a patch, the risk remains elevated for any systems deploying the vulnerable project.