---
id: "CVE-2026-120342"
kind: "vulnerability"
aliases: ["CVE-2026-120342"]
title: "CloudClassroom-PHP-Project: SQL injection in viewquery.php lets attackers read database"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "CloudClassroom-PHP-Project", "fixed": [], "affected": "commits 5dadec098bfbbf3300d60c3494db3fb95b66e7be, c46ce5736007d9d6e51a8feeb9250729fe85f139, dae0c5961a35a4faf28cde9e02117538f09f81c1 (rolling release, no versions)", "ecosystem": "other"}]
ecosystems: []
tags: ["cloudclassroom-php-project", "other", "php", "self-hosted"]
not_affected_if: ["project-not-deployed"]
published_at: "2026-11-02T05:18:24+00:00"
first_seen_at: "2026-11-02T05:21:35+00:00"
updated_at: "2026-11-02T05:24:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120342", "first_seen_at": "2026-11-02T05:21:35+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T05:24:51+00:00"}]
---

# CloudClassroom-PHP-Project: SQL injection in viewquery.php lets attackers read database

The mathurvishal CloudClassroom-PHP-Project has an SQL injection flaw in the eid argument of viewquery.php. A remote attacker can send crafted input to read or alter the application's database, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:CloudClassroom-PHP-Project affected commits 5dadec098bfbbf3300d60c3494db3fb95b66e7be, c46ce5736007d9d6e51a8feeb9250729fe85f139, dae0c5961a35a4faf28cde9e02117538f09f81c1 (rolling release, no versions) fixed ?

## How to check

Find viewquery.php in your deployment. In the upstream master it reads $_GET['eid'] and puts it straight into: SELECT * FROM query WHERE Eid='$seid'. If your copy still does this (no prepared statements), it is vulnerable. Also check web logs for requests to viewquery.php with quotes, UNION or SELECT in eid. Also check whether other pages of the same project (viewresult.php, updatedetailsfromfaculty.php etc.) are in use, as many have separate SQLi CVEs.

## Fix

No upstream fix known. VulDB says the vendor did not respond to disclosure. Workaround: take viewquery.php offline or block it at the web server/WAF, or change the query to a mysqli prepared statement with a bound eid.

## Timeline

- 2026-11-02T05:21:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120342
- 2026-11-02T05:24:51+00:00 analyst — Sources: VulDB VDB-429667 (not vendor; says no auth needed, PoC public, vendor silent) and upstream viewquery.php source showing unsanitized eid in SQL. NVD page returned empty. No vendor advisory or fix found, so nothing marked verified. Did not find the PoC link itself, so exploited stays false and poc_count stays 0.

## Documents

- [advisory] VulDB VDB-429667: CloudClassroom-PHP-Project viewquery.php eid sql injection https://vuldb.com/vuln/429667
- [describes] viewquery.php source (master): eid concatenated into SQL https://github.com/mathurvishal/CloudClassroom-PHP-Project/blob/master/viewquery.php

## From the sources

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_