Executive brief
CloudClassroom PHP is a web application for managing classroom activities. An authenticated attacker can inject malicious SQL commands through the guest name update feature, allowing them to extract sensitive database information including credentials and compromise data confidentiality and integrity. The vulnerability requires an attacker to be logged in but does not require user interaction or additional privileges.
Technical details
The vulnerability is a SQL injection flaw in the /updateguest.php endpoint that fails to sanitize the gname parameter, instead concatenating user input directly into SQL queries without prepared statements. An authenticated attacker can exploit this via POST request to extract database metadata, enumerate tables and columns, dump data, and retrieve admin credentials. No official patch is currently available from the vendor.
Affected products
- mathurvishal CloudClassroom PHP Project 1.0 and prior (rolling release)
Timeline
- 2026-08-03: disclosed
- 2026-09-26: advisory