The vulnerability allows an attacker to inject arbitrary SQL through the editassid argument in managevideos2.php. This flaw enables execution of unintended queries against the backend database, potentially exposing sensitive data or allowing unauthorized data modification. As a result, confidentiality and integrity of database records may be compromised. The flaw is identified as CWE‑74 and CWE‑89.

Affected systems are instances of mathurvishal’s CloudClassroom‑PHP‑Project. The issue exists up to the code revision 5dadec098bfbbf3300d60c3494db3fb95b66e7be, and because the project follows a rolling‑release model, specific version numbers are not published. Any deployment that hosts managevideos2.php without the described fixes remains vulnerable.

The CVSS score of 5.3 places the vulnerability in the medium severity range. EPSS information is not available, and the defect is not listed in the CISA KEV catalog. Verification of the attack vector shows it can be triggered remotely by supplying a crafted value for editassid, meaning the exposed web interface must be trusted. Given the public disclosure, exploitation is possible, and the risk is heightened for systems exposed to untrusted users.