The vulnerability is a SQL injection flaw in the updatefaculty.php script of the CloudClassroom-PHP-Project. Manipulating the fid argument permits an attacker to inject arbitrary SQL, potentially enabling unauthorized read, modification, or deletion of database contents. The flaw relies on insufficient input validation, consistent with CWE-74 and CWE-89 classification.

Affected systems are installations of mathurvishal CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The product employs a rolling release model, so no specific affected version list is available. The vendor has not responded to disclosure, leaving users uncertain whether newer commits include the fix.

The CVSS score of 6.9 indicates moderate severity; EPSS is not available and the vulnerability is not listed in KEV. Attackers can trigger the flaw remotely by sending a crafted request to updatefaculty.php. Published exploit code demonstrates feasibility, so the risk is real. Since the attack vector is likely remote, any exposed instance of the application is vulnerable. The lack of a public fix heightens the urgency for mitigations.