{"id":"CVE-2026-120342","kind":"vulnerability","aliases":["CVE-2026-120342"],"related":[],"title":"CloudClassroom-PHP-Project: SQL injection in viewquery.php lets attackers read database","description":"A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The mathurvishal CloudClassroom-PHP-Project has an SQL injection flaw in the eid argument of viewquery.php. A remote attacker can send crafted input to read or alter the application's database, and a public exploit exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CloudClassroom-PHP-Project","fixed":[],"affected":"commits 5dadec098bfbbf3300d60c3494db3fb95b66e7be, c46ce5736007d9d6e51a8feeb9250729fe85f139, dae0c5961a35a4faf28cde9e02117538f09f81c1 (rolling release, no versions)","ecosystem":"other"}],"ecosystems":[],"tags":["cloudclassroom-php-project","other","php","self-hosted"],"not_affected_if":["project-not-deployed"],"how_to_check":"Find viewquery.php in your deployment. In the upstream master it reads $_GET['eid'] and puts it straight into: SELECT * FROM query WHERE Eid='$seid'. If your copy still does this (no prepared statements), it is vulnerable. Also check web logs for requests to viewquery.php with quotes, UNION or SELECT in eid. Also check whether other pages of the same project (viewresult.php, updatedetailsfromfaculty.php etc.) are in use, as many have separate SQLi CVEs.","fix":"No upstream fix known. VulDB says the vendor did not respond to disclosure. Workaround: take viewquery.php offline or block it at the web server/WAF, or change the query to a mysqli prepared statement with a bound eid.","status":"open","published_at":"2026-11-02T05:18:24+00:00","first_seen_at":"2026-11-02T05:21:35+00:00","triaged_at":"2026-11-02T05:23:32+00:00","updated_at":"2026-11-02T05:24:51+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-02T05:23:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CloudClassroom-PHP-Project: SQL injection in viewquery.php lets attackers read database","impact":"high","summary":"The mathurvishal CloudClassroom-PHP-Project has an SQL injection flaw in the eid argument of viewquery.php. A remote attacker can send crafted input to read or alter the application's database, and a public exploit exists.","audience":"businesses","category":"other","nicknames":[],"who_cares":["php","cloudclassroom-php-project","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads or modifies the application database remotely","analyst_note":"Confirm whether the project has an upstream fix or commit and whether authentication is required to reach viewquery.php; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120342.","how_to_check":"- Look for `viewquery.php` in the project files and check whether it builds SQL queries from the `eid` parameter without parameterized statements.\n- Confirm whether your deployment runs this project at all (unknown for version identification, since the sources give no version information).","plain_action":"","needs_analyst":true,"not_affected_if":["project-not-deployed"],"who_is_affected":"Teams running the CloudClassroom-PHP-Project web application that exposes viewquery.php to the network are exposed when the eid parameter reaches a database query. The sources report a rolling release with no version information, so affected and fixed versions are unknown. Installations that do not run this project can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4169,"output_tokens":588,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether the project has an upstream fix or commit and whether authentication is required to reach viewquery.php; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120342.","search":"'-120342':15A,18A '-2026':14A,17A 'affect':80C,129C 'alter':59B 'applic':61B 'argument':46B,94C 'attack':10A,51B,101C 'cloudclassroom':2A,20A,24B,35B,76C 'cloudclassroom-php-project':1A,19A,23B,34B,75C 'contact':138C 'craft':54B 'cve':13A,16A 'databas':12A,63B 'deliveri':123C 'detect':72C 'disclosur':142C 'earli':139C 'eid':45B,95C 'element':81C 'execut':104C 'exist':68B 'exploit':67B,107C 'file':88C 'flaw':42B 'function':85C 'host':31B 'implement':117C 'inform':127C 'inject':6A,41B,99C 'input':55B 'let':9A 'manipul':91C 'mathurvish':33B,74C 'may':112C 'mean':125C 'ongo':122C 'php':3A,21A,25B,28B,36B,77C 'product':116C 'project':4A,22A,26B,37B,78C 'public':66B,110C 'read':11A,57B 'releas':120C,132C 'remot':50B,105C 'respond':146C 'result':96C 'roll':119C 'self':30B 'self-host':29B 'send':53B 'sql':5A,40B,98C 'unavail':134C 'unknown':84C 'updat':131C 'use':114C 'vendor':136C 'version':126C 'viewquery.php':8A,48B,89C 'vulner':70C 'way':149C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the open-source CloudClassroom-PHP-Project (mathurvishal) e-learning app, typically self-hosted on XAMPP/PHP and MySQL, with viewquery.php reachable. VulDB states no authentication is needed, so it can be exploited remotely. The project has no versions (rolling release), so every copy built from the listed commits should be treated as affected. Anyone not running this project can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["cloudclassroomphpproject"],"ptokens":["cloudclassroom","php","project"],"labels":["cloudclassroomphpproject","high","other","php","selfhosted"],"first_public_at":"2026-11-02T05:18:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120342","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120342","severity":null,"published_at":"2026-11-02T05:18:24+00:00","modified_at":"2026-11-02T05:18:24+00:00","first_seen_at":"2026-11-02T05:21:35+00:00","fetched_at":"2026-11-02T05:21:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120342:1348","url":null,"severity":null,"published_at":"2026-11-02T05:24:51+00:00","modified_at":"2026-11-02T05:24:51+00:00","first_seen_at":"2026-11-02T05:24:51+00:00","fetched_at":"2026-11-02T05:24:51+00:00","note":"Sources: VulDB VDB-429667 (not vendor; says no auth needed, PoC public, vendor silent) and upstream viewquery.php source showing unsanitized eid in SQL. NVD page returned empty. No vendor advisory or fix found, so nothing marked verified. Did not find the PoC link itself, so exploited stays false and poc_count stays 0."}],"documents":[{"id":50401,"url":"https://vuldb.com/vuln/429667","title":"VulDB VDB-429667: CloudClassroom-PHP-Project viewquery.php eid sql injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":50402,"url":"https://github.com/mathurvishal/CloudClassroom-PHP-Project/blob/master/viewquery.php","title":"viewquery.php source (master): eid concatenated into SQL","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}