SECURITYHIGHCVE-2026-100314

CVE-2026-100314: SQL Injection in CloudClassroom-PHP-Project Student Details Update

CloudClassroom-PHP-Project is vulnerable to remote SQL injection via the eno parameter in updatedetailsfromstudent.php; the vendor has not responded.

Dylan H.

Security Team

September 27, 2026
4 min read
CVE-2026-100314: SQL Injection in CloudClassroom-PHP-Project Student Details Update

Affected Products

  • mathurvishal CloudClassroom-PHP-Project (up to commit 5dadec0)

Overview

A SQL injection vulnerability has been disclosed in mathurvishal's CloudClassroom-PHP-Project, an open-source PHP/MySQL classroom management script hosted on GitHub. Tracked as CVE-2026-100314, the flaw affects an unknown function in updatedetailsfromstudent.php, where the eno argument (a student enrollment-number field) is passed into a SQL query without sanitization. The attack can be launched remotely without authentication, and technical details along with a public exploit have already circulated.

The same project ships a closely related flaw disclosed the same day, CVE-2026-100315, affecting the myfid parameter in mydetailsfaculty.php — administrators running this codebase should treat both as in scope for remediation, along with a wider cluster of CVE-2026-100311 through CVE-2026-100313 reported against the same commit range.


Technical Details

FieldValue
CVE IDCVE-2026-100314
CWECWE-89 (SQL Injection)
SeverityHigh (CVSS 3.1/3.0: 7.3); rated Medium under CVSS 4.0 (6.9)
Attack VectorNetwork
Privileges RequiredNone
Vulnerable Fileupdatedetailsfromstudent.php
Vulnerable Parametereno
Affected CommitUp to 5dadec098bfbbf3300d60c3494db3fb95b66e7be
Exploit AvailabilityPublic exploit disclosed
AssignerVulDB
Vendor ResponseContacted early about the disclosure; did not respond

How It Works

updatedetailsfromstudent.php accepts an eno value — a student enrollment number used to locate and update a student record — and concatenates it directly into a SQL statement instead of using a parameterized query. An attacker who submits a crafted eno value can alter the query's logic to read data outside the intended student record, including other students' personal details or, depending on database permissions, adjacent tables entirely unrelated to the update-details workflow.

Because the endpoint requires no authentication and a single crafted HTTP request is sufficient, exploitation requires no special access or user interaction. The project uses a rolling-release development model, so no specific "fixed version" exists to upgrade to — every deployment tracking the affected commit range is presumed vulnerable.


Impact Assessment

Impact AreaDescription
Data ConfidentialityAttacker-controlled queries can extract arbitrary rows from the application database, including student records and, if stored in-band, administrator or faculty credentials
Data IntegrityDepending on the underlying query and database permissions, UNION- or stacked-query-based injection could allow data modification
AvailabilityMalformed queries could degrade or crash the database backend under sustained abuse
Attack ComplexityLow — no authentication or user interaction required, and a public exploit already exists

CloudClassroom-PHP-Project is a hobbyist/educational codebase typically deployed by students or small institutions learning PHP/MySQL development rather than a production enterprise LMS — but that also means it is frequently deployed with default configurations, minimal hardening, and no formal patch process.


Mitigation

  • No vendor patch exists. The maintainer was notified and did not respond; there is no fixed release to upgrade to given the project's rolling-release model.
  • Rewrite the vulnerable query using parameterized statements (e.g., PDO prepared statements or mysqli bound parameters) if you maintain a fork or deployment of this codebase.
  • Do not expose this application to the public internet without a web application firewall capable of blocking SQL injection payloads in front of it.
  • Audit mydetailsfaculty.php as well, given the related CVE-2026-100315 affects the same injection pattern via its myfid parameter.
  • Review database and web server logs for anomalous updatedetailsfromstudent.php requests containing SQL syntax (UNION, OR 1=1, comment sequences) to check for prior exploitation.
  • Consider migrating off this codebase entirely for any deployment handling real student PII.

References