CloudClassroom-PHP-Project SQL injection in facultydetails.php delete function
A PHP classroom program can let attackers steal its data.
Summary
Manipulating the deleteid argument in facultydetails.php of CloudClassroom-PHP-Project leads to SQL injection, which can be started remotely. A public exploit exists, and the vendor did not respond to early contact about the disclosure.
What to do
No fixed version is listed, and the vendor did not respond. Check the project repository for a fix, and do not leave this program open to the internet until one is applied.
Products and platforms
CVE IDs
Sources
Times
First published
First seen