CVE-2026-97884: mathurvishal CloudClassroom-PHP-Project Student Update Functionality updatestudent.php sql injection
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatestudent.php of the component Student Update Functionality. The manipulation of the argument eno results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable, but the assigned vector indicates that the attacker needs low-level privileges. No user interaction is required.
Which deployments should be treated as potentially affected?
The affected project is identified only up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Because the product does not use versioning, affected and unaffected releases cannot be determined from the available information.
How can defenders identify exposure?
Review uses of the Student Update Functionality in updatestudent.php, specifically handling of the eno argument. Manipulation of that argument is identified as the SQL injection path.
How urgent is remediation?
A public exploit is available, and the issue can affect confidentiality, integrity, and availability. The vendor did not respond to the disclosure, so organizations may need to assess and mitigate the affected code themselves.