PT-2026-98960 · Unknown · Cloudclassroom-Php Project
CVE-2026-97884
·
Published
2026-09-25
·
Updated
2026-09-25
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be
Description
A remote SQL injection exists within the Student Update Functionality component in the
updatestudent.php file. The issue occurs when the eno argument is manipulated, allowing an attacker to execute arbitrary SQL commands on the database.Recommendations
Update CloudClassroom-PHP-Project to a version later than 5dadec098bfbbf3300d60c3494db3fb95b66e7be.
As a temporary mitigation, restrict access to the
updatestudent.php file or avoid using the eno parameter until a fix is applied.Exploit
Fix
SQL injection
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cloudclassroom-Php Project