{"id":"CVE-2026-121502","kind":"vulnerability","aliases":["CVE-2026-121502"],"related":[],"title":"CloudClassroom-PHP-Project: SQL injection in faculty details page via deleteid","description":"A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A PHP classroom project's facultydetails.php page passes the deleteid parameter into a SQL query without sanitizing it. An attacker can send crafted requests to read or change database contents.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CloudClassroom-PHP-Project","fixed":[],"affected":"rolling release, no versions; master facultydetails.php as read 2026-11-03","ecosystem":"github"}],"ecosystems":[],"tags":["cloudclassroom-php-project","mysql","package","php"],"not_affected_if":["facultydetails-removed","project-not-deployed"],"how_to_check":"Open facultydetails.php in your copy of mathurvishal/CloudClassroom-PHP-Project. It is vulnerable if $_GET['deleteid'] is put straight into the query (DELETE FROM facutlytable WHERE FID = $deleteid) with no cast or prepared statement. Check web logs for requests to facultydetails.php with a deleteid value that is not a plain number.","fix":null,"status":"open","published_at":"2026-11-03T21:17:36+00:00","first_seen_at":"2026-11-03T21:19:30+00:00","triaged_at":"2026-11-03T21:20:36+00:00","updated_at":"2026-11-03T21:21:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T21:20:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CloudClassroom-PHP-Project: SQL injection in faculty details page via deleteid","impact":"high","summary":"A PHP classroom project's facultydetails.php page passes the deleteid parameter into a SQL query without sanitizing it. An attacker can send crafted requests to read or change database contents.","audience":"developers","category":"package","nicknames":[],"who_cares":["php","cloudclassroom-php-project","mysql"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"database contents readable and modifiable by remote attacker","analyst_note":"Confirm whether the rolling-release project has a patched commit or fixed file state, and whether authentication is required to reach facultydetails.php; source is NVD only.","how_to_check":"- Look for `facultydetails.php` in the deployed CloudClassroom-PHP-Project code and check whether `deleteid` is used directly in a SQL query\n- unknown for version checks, since the sources say the product uses a rolling release with no version information","plain_action":"","needs_analyst":true,"not_affected_if":["project-not-deployed"],"who_is_affected":"Any deployment of the mathurvishal CloudClassroom-PHP-Project that includes facultydetails.php is exposed to remote SQL injection through the deleteid argument. The sources give no version information, so the exposure depends on whether the deployed code still contains the vulnerable file. Installations that do not run this project can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4181,"output_tokens":558,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether the rolling-release project has a patched commit or fixed file state, and whether authentication is required to reach facultydetails.php; source is NVD only.","search":"'-121502':15A,18A '-2026':14A,17A 'affect':124C 'argument':85C 'attack':49B,92C 'avail':101C,130C 'chang':57B 'classroom':32B 'cloudclassroom':2A,20A,24B,67C 'cloudclassroom-php-project':1A,19A,23B,66C 'contact':134C 'content':59B 'continu':115C 'craft':52B 'cve':13A,16A 'databas':58B 'deleteid':12A,39B,86C 'deliv':114C 'detail':9A 'disclosur':138C 'earli':135C 'element':72C 'exploit':98C 'faculti':8A 'facultydetails.php':35B,80C 'file':79C 'function':76C 'identifi':63C 'impact':71C 'inform':122C 'initi':95C 'inject':6A,90C 'lead':87C 'manipul':82C 'mathurvish':65C 'may':93C 'might':103C 'model':112C 'mysql':27B 'packag':28B 'page':10A,36B 'paramet':40B 'pass':37B 'php':3A,21A,25B,29B,31B,68C 'product':107C 'project':4A,22A,26B,33B,69C 'public':100C 'queri':44B 'read':55B 'releas':111C,127C 'remot':96C 'request':53B 'respond':142C 'result':119C 'roll':110C 'sanit':46B 'send':51B 'specif':120C 'sql':5A,43B,89C 'unknown':75C 'updat':116C,126C 'use':105C,108C 'vendor':132C 'version':121C 'via':11A 'vulner':61C 'way':145C 'without':45B","nicknames":[],"mitigations":[],"who_affected":"Anyone running a copy of mathurvishal/CloudClassroom-PHP-Project (a rolling-release PHP/MySQL classroom app) that includes facultydetails.php. In the master file, deleteid goes unescaped into a DELETE statement. The file redirects to AdminLogin.php when no session is set, but the code shown has no exit after the redirect, so the query may still run for unauthenticated requests (not tested). Anyone not running this project can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["cloudclassroomphpproject"],"ptokens":["cloudclassroom","php","project"],"labels":["cloudclassroomphpproject","high","mysql","package","php"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121502","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121502","severity":null,"published_at":"2026-11-03T21:17:36+00:00","modified_at":"2026-11-03T21:17:36+00:00","first_seen_at":"2026-11-03T21:19:30+00:00","fetched_at":"2026-11-03T21:19:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121502:1569","url":null,"severity":null,"published_at":"2026-11-03T21:21:42+00:00","modified_at":"2026-11-03T21:21:42+00:00","first_seen_at":"2026-11-03T21:21:42+00:00","fetched_at":"2026-11-03T21:21:42+00:00","note":"Read master facultydetails.php on GitHub: deleteid concatenated into DELETE query; session check uses header() without exit. NVD says the vendor did not respond and no fixed version exists; no patched commit found. Only NVD plus code read, nothing verified."}],"documents":[{"id":60949,"url":"https://github.com/mathurvishal/CloudClassroom-PHP-Project/blob/master/facultydetails.php","title":"facultydetails.php source (master)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":60950,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121502","title":"NVD CVE-2026-121502","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}