Executive Summary
A SQL injection vulnerability (CVE-2026-100739) has been disclosed in CloudClassroom-PHP-Project, an open-source PHP learning-management codebase maintained by GitHub user mathurvishal. The flaw resides in viewresult.php, where the seno request argument is concatenated directly into a SQL query without sanitization. The vulnerability is remotely exploitable, a public exploit exists, and the maintainer did not respond to disclosure attempts.
CVSS Score: 7.3 (High)
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-100739 |
| CVSS Score | 7.3 (High) |
| Type | SQL Injection (CWE-89) |
| Affected File | viewresult.php |
| Vulnerable Parameter | seno |
| Attack Vector | Network |
| Privileges Required | None documented |
| Public Exploit | Yes |
| Vendor Response | None — maintainer did not respond to disclosure |
| Published | 2026-09-27 |
Affected Products
| Product | Affected Revisions | Status |
|---|---|---|
| CloudClassroom-PHP-Project | Up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be | Vulnerable, no fix available |
CloudClassroom-PHP-Project is a rolling-release codebase with no versioned tags, which means there is no clean "affected version range" — any deployment built from the vulnerable commit or earlier is exposed, and there is currently no confirmed fixed commit.
Technical Details
Root Cause
viewresult.php takes the seno parameter directly from the request and inserts it into a SQL statement without parameterization, escaping, or type validation. Because seno is expected to be numeric (a student/serial identifier used to look up exam results), the endpoint likely performs no input filtering at all beyond assuming well-formed callers.
Attack Chain
1. Attacker identifies a CloudClassroom-PHP-Project deployment
exposing viewresult.php
2. Attacker sends a request with a malicious seno value, e.g.:
viewresult.php?seno=1' OR '1'='1
3. The unsanitized value is concatenated into the backend SQL query
4. The database executes attacker-controlled SQL logic alongside
the intended query
5. Depending on the query context, this can expose other students'
results, enumerate database schema, or — if the database user
has sufficient privileges — read or modify arbitrary tablesImpact Assessment
| Impact Area | Description |
|---|---|
| Data Exposure | Unauthorized access to exam results and potentially other student/user records |
| Database Enumeration | Attackers can map schema and pivot to other injectable endpoints in the same codebase |
| Integrity Risk | Depending on database privileges, injected queries could modify grades or records |
| No Vendor Fix | The unresponsive maintainer means organizations running this project must self-remediate or replace it |
Recommendations
Immediate Actions
- Do not expose CloudClassroom-PHP-Project deployments to untrusted networks until the code is patched or replaced.
- Manually patch
viewresult.phpto use parameterized queries (prepared statements) for thesenolookup — do not rely on string sanitization alone. - Deploy a WAF rule blocking common SQL injection patterns (
',OR 1=1,UNION SELECT, etc.) on thesenoparameter as an interim mitigation, understanding this is not a substitute for fixing the query. - Audit other endpoints in the same project for the same unparameterized-query pattern — this codebase has multiple related SQL injection CVEs disclosed in the same batch (e.g. CVE-2026-100874, CVE-2026-100875).
Detection
- Monitor web server and application logs for anomalous
senovalues containing SQL metacharacters (',--,;,UNION,OR). - Alert on database errors surfaced to the client, which may indicate injection attempts probing query structure.