Overview
A second SQL injection vulnerability disclosed the same day in mathurvishal's CloudClassroom-PHP-Project, an open-source PHP/MySQL classroom management script hosted on GitHub. Tracked as CVE-2026-100315, the flaw affects an unknown function in mydetailsfaculty.php, where the myfid argument (a faculty ID field) is passed into a SQL query without sanitization. The attack can be launched remotely without authentication; technical details and a proof-of-concept exploit are public.
This flaw sits alongside CVE-2026-100314, a matching SQL injection in updatedetailsfromstudent.php disclosed in the same batch, plus CVE-2026-100311 through CVE-2026-100313 covering XSS and related issues against the same commit range. Administrators running this codebase should treat the entire cluster as in scope for remediation, not just this single CVE.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-100315 |
| CWE | CWE-89 (SQL Injection) |
| Severity | High (CVSS 3.1: 7.3) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Vulnerable File | mydetailsfaculty.php |
| Vulnerable Parameter | myfid |
| Affected Commit | Up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be |
| Exploit Availability | Public proof-of-concept |
| Assigner | GCVE Database |
| Vendor Response | Contacted early about the disclosure; did not respond |
How It Works
mydetailsfaculty.php accepts a myfid value — a faculty identifier used to look up and display an instructor's profile details — and concatenates it directly into a SQL statement rather than using a parameterized query. An attacker who submits a crafted myfid value can manipulate the query to read data outside the intended faculty record, including other staff members' personal information or unrelated database tables, depending on the account's database privileges.
Because the endpoint requires no authentication, no user interaction, and can be triggered with a single crafted HTTP request, exploitation complexity is low. Researchers additionally note that vulnerable installations can be located via simple search-engine dorking against the distinctive mydetailsfaculty.php filename. As with its sibling CVE, the project's rolling-release model means there is no version number to patch to — only source-level fixes.
Impact Assessment
| Impact Area | Description |
|---|---|
| Data Confidentiality | Attacker-controlled queries can extract arbitrary rows from the application database, including faculty and student PII and, if stored in-band, credential data |
| Data Integrity | Depending on the underlying query and database permissions, UNION- or stacked-query-based injection could allow data modification |
| Availability | Malformed queries could degrade or crash the database backend under sustained abuse |
| Discoverability | Vulnerable instances can be found via search-engine dorking (inurl:mydetailsfaculty.php), increasing the likelihood of opportunistic mass scanning |
CloudClassroom-PHP-Project is a hobbyist/educational codebase rather than a maintained enterprise LMS, which means fixes are unlikely to arrive on any predictable timeline — and deployments handling real student or staff data carry outsized risk relative to the software's intended use case.
Mitigation
- No vendor patch exists. The maintainer did not respond to early disclosure, and the project's rolling-release model means there is no fixed version to upgrade to.
- Rewrite the vulnerable query using parameterized statements (e.g., PDO prepared statements or
mysqlibound parameters) if you maintain a fork or deployment of this codebase. - Do not expose this application to the public internet without a web application firewall capable of blocking SQL injection payloads in front of it.
- Audit
updatedetailsfromstudent.phpas well, given the related CVE-2026-100314 affects the same injection pattern via itsenoparameter. - Search for exposed instances using the same dorking technique attackers would use (
inurl:mydetailsfaculty.php) to confirm whether your deployment is internet-facing. - Consider migrating off this codebase entirely for any deployment handling real faculty or student PII.