CVE-2026-120342
Received Received - Intake

SQL Injection in CloudClassroom-PHP-Project

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulDB

Description
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120342

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mathurvishal CloudClassroom-PHP-Project 5dadec098bfbbf3300d60c3494db3fb95b66e7be
mathurvishal CloudClassroom-PHP-Project c46ce5736007d9d6e51a8feeb9250729fe85f139
mathurvishal CloudClassroom-PHP-Project dae0c5961a35a4faf28cde9e02117538f09f81c1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in the CloudClassroom PHP Project version 1.0. It affects the viewquery.php file where the eid parameter is improperly sanitized and directly used in SQL queries. Attackers can manipulate this parameter to inject malicious SQL code, potentially accessing sensitive data.

Detection Guidance

To detect this SQL injection vulnerability, inspect the viewquery.php file in the CloudClassroom PHP Project for improper input handling of the eid parameter. Check if user input is directly interpolated into SQL queries without sanitization. Use tools like SQLmap to test for SQL injection by sending crafted payloads to the eid parameter. Example command: sqlmap -u "http://target/viewquery.php?eid=1" --batch.

  • Review the source code of viewquery.php for direct SQL query construction using the eid parameter.
  • Use automated scanners like OWASP ZAP or Burp Suite to identify SQL injection points in the application.
Impact Analysis

An attacker could exploit this to extract sensitive data like admin credentials, modify or delete database contents, or gain unauthorized access to the system. The exploit is publicly available and can be executed remotely without authentication.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately update or patch the CloudClassroom PHP Project to a version that properly sanitizes the eid parameter. If no patch is available, implement input validation to reject non-numeric values for eid. Use prepared statements with parameterized queries instead of direct SQL string concatenation.

  • Apply web application firewall rules to block SQL injection attempts targeting the eid parameter.
  • Monitor network traffic for suspicious queries or unusual access patterns to the viewquery.php endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120342. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...