Overview
A SQL injection vulnerability has been disclosed in mathurvishal's CloudClassroom-PHP-Project, an open-source PHP/MySQL classroom management script hosted on GitHub. Tracked as CVE-2026-100314, the flaw affects an unknown function in updatedetailsfromstudent.php, where the eno argument (a student enrollment-number field) is passed into a SQL query without sanitization. The attack can be launched remotely without authentication, and technical details along with a public exploit have already circulated.
The same project ships a closely related flaw disclosed the same day, CVE-2026-100315, affecting the myfid parameter in mydetailsfaculty.php — administrators running this codebase should treat both as in scope for remediation, along with a wider cluster of CVE-2026-100311 through CVE-2026-100313 reported against the same commit range.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-100314 |
| CWE | CWE-89 (SQL Injection) |
| Severity | High (CVSS 3.1/3.0: 7.3); rated Medium under CVSS 4.0 (6.9) |
| Attack Vector | Network |
| Privileges Required | None |
| Vulnerable File | updatedetailsfromstudent.php |
| Vulnerable Parameter | eno |
| Affected Commit | Up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be |
| Exploit Availability | Public exploit disclosed |
| Assigner | VulDB |
| Vendor Response | Contacted early about the disclosure; did not respond |
How It Works
updatedetailsfromstudent.php accepts an eno value — a student enrollment number used to locate and update a student record — and concatenates it directly into a SQL statement instead of using a parameterized query. An attacker who submits a crafted eno value can alter the query's logic to read data outside the intended student record, including other students' personal details or, depending on database permissions, adjacent tables entirely unrelated to the update-details workflow.
Because the endpoint requires no authentication and a single crafted HTTP request is sufficient, exploitation requires no special access or user interaction. The project uses a rolling-release development model, so no specific "fixed version" exists to upgrade to — every deployment tracking the affected commit range is presumed vulnerable.
Impact Assessment
| Impact Area | Description |
|---|---|
| Data Confidentiality | Attacker-controlled queries can extract arbitrary rows from the application database, including student records and, if stored in-band, administrator or faculty credentials |
| Data Integrity | Depending on the underlying query and database permissions, UNION- or stacked-query-based injection could allow data modification |
| Availability | Malformed queries could degrade or crash the database backend under sustained abuse |
| Attack Complexity | Low — no authentication or user interaction required, and a public exploit already exists |
CloudClassroom-PHP-Project is a hobbyist/educational codebase typically deployed by students or small institutions learning PHP/MySQL development rather than a production enterprise LMS — but that also means it is frequently deployed with default configurations, minimal hardening, and no formal patch process.
Mitigation
- No vendor patch exists. The maintainer was notified and did not respond; there is no fixed release to upgrade to given the project's rolling-release model.
- Rewrite the vulnerable query using parameterized statements (e.g., PDO prepared statements or
mysqlibound parameters) if you maintain a fork or deployment of this codebase. - Do not expose this application to the public internet without a web application firewall capable of blocking SQL injection payloads in front of it.
- Audit
mydetailsfaculty.phpas well, given the related CVE-2026-100315 affects the same injection pattern via itsmyfidparameter. - Review database and web server logs for anomalous
updatedetailsfromstudent.phprequests containing SQL syntax (UNION,OR 1=1, comment sequences) to check for prior exploitation. - Consider migrating off this codebase entirely for any deployment handling real student PII.