Falcon09

**Name of the Vulnerable Software and Affected Versions** mathurvishal CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be **Description** Remote SQL injection is possible due to improper processing of the `gname` argument within the 'updateguest.php' file. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database. **Recommendations** As a temporary workaround, avoid using the `gname` argument in the 'updateguest.php' file until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be **Description** A remote SQL injection is possible through the manipulation of the `gname` or `editassid` arguments within an unknown function of the `/updateguest.php` endpoint. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** As a temporary workaround, restrict access to the `/updateguest.php` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.