---
id: "CVE-2026-120341"
kind: "vulnerability"
aliases: ["CVE-2026-120341"]
title: "CloudClassroom-PHP-Project: studentdetails.php keeps running after a redirect, so protected content can be reached without login"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "CloudClassroom-PHP-Project", "fixed": [], "affected": "commits 5dadec098bfbbf3300d60c3494db3fb95b66e7be, c46ce5736007d9d6e51a8feeb9250729fe85f139, dae0c5961a35a4faf28cde9e02117538f09f81c1 (rolling release)", "ecosystem": "generic"}]
ecosystems: []
tags: ["cloudclassroom-php-project", "cwe-698", "execution-after-redirect", "package", "php"]
not_affected_if: ["auth-required", "not-deployed"]
published_at: "2026-11-02T05:18:23+00:00"
first_seen_at: "2026-11-02T05:21:35+00:00"
updated_at: "2026-11-02T05:24:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120341", "first_seen_at": "2026-11-02T05:21:35+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T05:24:48+00:00"}]
---

# CloudClassroom-PHP-Project: studentdetails.php keeps running after a redirect, so protected content can be reached without login

VulDB classifies this as CWE-698 (execution after redirect): studentdetails.php sends a redirect but does not stop executing, so the rest of the page runs. VulDB says no authentication is required and a public proof of concept exists. This is not described as remote code execution. The vendor did not respond, and the repo is rolling-release with no fixed version.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- generic:CloudClassroom-PHP-Project affected commits 5dadec098bfbbf3300d60c3494db3fb95b66e7be, c46ce5736007d9d6e51a8feeb9250729fe85f139, dae0c5961a35a4faf28cde9e02117538f09f81c1 (rolling release) fixed ?

## How to check

Look for studentdetails.php from mathurvishal/CloudClassroom-PHP-Project (commits 5dadec09, c46ce573, dae0c596 are listed by VulDB; no other versions are stated). In the file, look for header('Location: ...') without exit; or die; right after it. Test: request the page without a session and check whether the response body still contains the admin content despite the 302. Also check other admin pages of the project for the same pattern.

## Fix

No fix: VulDB says the vendor did not respond and no countermeasure is known. Workaround: add exit; after each header('Location: ...') redirect, or require authentication in front of the app, or stop using the project.

## Timeline

- 2026-11-02T05:21:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120341
- 2026-11-02T05:24:48+00:00 analyst — Read VulDB VDB-429666 (secondary; CNA) and repo file (PHP source not rendered). Triage 'code execution' wording is wrong: CWE-698 execution after redirect, unauthenticated per VulDB, PoC public on GitHub (link not shown). Nothing verified: no maintainer page. Sample/student project, low real-world exposure.

## Documents

- [advisory] VulDB VDB-429666: CloudClassroom-PHP-Project studentdetails.php redirect https://vuldb.com/vuln/429666
- [describes] studentdetails.php (repo, master) https://github.com/mathurvishal/CloudClassroom-PHP-Project/blob/master/studentdetails.php

## From the sources

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project. Impacted is an unknown function of the file studentdetails.php. The manipulation leads to execution after redirect. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_